Legal
Subprocessors
The third parties PCQ relies on to deliver its services, and what each one handles.
Last updated: 10 November 2026 · Version 1.3
When we deliver services to you, we sometimes rely on third parties who process personal data on our behalf. Under UK data protection law these are called subprocessors, and we are required to tell you who they are.
If you are a home customer, the same suppliers act as our processors when we deliver your services, and our Privacy Notice explains how we handle your data.
This page lists every subprocessor we currently engage. It is the authoritative version — the list attached to your Data Processing Agreement reflects the position when that agreement was signed, and this page reflects the position today.
Which of these apply to you depends on which services you buy from us. A customer who takes only broadband will have very few; a customer taking Microsoft 365, hosting, backup and support will have most of them.
How we tell you about changes
We give 30 days’ notice before engaging a new subprocessor or replacing an existing one. We do this by updating this page and emailing the data protection contact you have given us.
If you want to receive these notifications, send us the contact address at [email protected] and we will add it to our notification list.
If you object to a new subprocessor on reasonable data protection grounds, tell us within the notice period and we will work with you to find a resolution. Where we cannot, you may terminate the affected service without penalty.
Occasionally we may need to engage a subprocessor at shorter notice to preserve the security or continuity of a service. If that happens we will tell you as soon as we can and explain why.
Productivity and communications
| Subprocessor | What they do for us | Entity location | Where your data is held | Transfer safeguard |
|---|---|---|---|---|
| Microsoft Ireland Operations Ltd | Microsoft 365 — email, files, identity and collaboration services | Ireland | United Kingdom | Covered by UK adequacy |
| Giacom / Cloud Market Ltd | Supplies and provisions our Microsoft 365 licences | United Kingdom | United Kingdom | Not applicable — UK |
| Swiftnet Ltd (trading as SCG) | Hosted telephony and VoIP; legacy telephony and broadband | United Kingdom | United Kingdom | Not applicable — UK |
Hosting and infrastructure
| Subprocessor | What they do for us | Entity location | Where your data is held | Transfer safeguard |
|---|---|---|---|---|
| HostPresto | Provides and maintains the physical servers our hosting platform runs on | United Kingdom | United Kingdom | Not applicable — UK |
| WebPros International GmbH (Plesk) | Hosting control panel software running on our servers | Switzerland | United Kingdom — runs on our UK infrastructure | Covered by UK adequacy |
| Cloudflare, Inc. | DNS, content delivery and web application firewall for customer domains | United States | Global edge network | International Data Transfer Addendum |
Backup and continuity
| Subprocessor | What they do for us | Entity location | Where your data is held | Transfer safeguard |
|---|---|---|---|---|
| Acronis International GmbH | Backup of Microsoft 365 data and hosted server data | Switzerland | United Kingdom (London) | Covered by UK adequacy |
| Livedrive Internet Ltd | Cloud backup of files on customer computers, where you take our Livedrive backup service | United Kingdom | United Kingdom | Not applicable — UK |
Acronis use their own subprocessors. Their current list is published at https://www.acronis.com/en-us/support/sub-processors/.
Security
| Subprocessor | What they do for us | Entity location | Where your data is held | Transfer safeguard |
|---|---|---|---|---|
| Bitdefender | Endpoint protection software on managed devices | Romania | EU | Covered by UK adequacy |
| Cloud Linux Software, Inc. (Imunify360) | Web application firewall, malware scanning and intrusion prevention on our hosting platform | United States | Germany, Finland and Poland, and the United States (security analysis servers and databases) | EU Standard Contractual Clauses with the UK Addendum (CloudLinux data processing addendum); Data Privacy Framework certified |
| CyberSmart Ltd | Endpoint compliance monitoring and Cyber Essentials certification support | United Kingdom | United Kingdom | Not applicable — UK |
| Octiga Software Limited | Microsoft 365 security monitoring and policy management, integrated with our Acronis backup. Holds administrative access to the Microsoft 365 tenants we manage, and reads activity and configuration data (sign-in events, user and mailbox settings). It does not collect email or file content | Ireland | Ireland (AWS, Dublin). Sign-in IP addresses and user email addresses are checked by security services in France and the United States | Covered by UK adequacy (EU). Onward checks in the US under the supplier’s Standard Contractual Clauses |
| KnowBe4, Inc. | Security awareness training and simulated phishing | United States | European Union (KnowBe4’s EU instance, hosted on AWS in Ireland and Germany) | Covered by UK adequacy (EU); International Data Transfer Addendum for access from the United States |
| Keeper Security, Inc. | Password management supplied to customers, and used internally by PCQ. Keeper operate a zero-knowledge architecture, which means vault contents are encrypted so that Keeper cannot read them. Administrative recovery features, where an organisation chooses to enable them, can allow recovery of a user’s vault — we will tell you what is configured for your organisation on request | United States | European Union (keepersecurity.eu) | Covered by UK adequacy (EU); International Data Transfer Addendum for access from the United States |
| AgileBits Inc. (1Password) | Password management used internally by PCQ, holding credentials for customer systems. Zero-knowledge architecture, which means 1Password cannot read vault contents | Canada | European Union (1Password.eu) | Covered by UK adequacy (Canada and EU). Zero-knowledge encryption |
Service management
| Subprocessor | What they do for us | Entity location | Where your data is held | Transfer safeguard |
|---|---|---|---|---|
| Syncro (Servably, Inc.) | Our service desk and remote monitoring and management platform. Holds support requests, your contact details and device inventory. Where we supply your Microsoft 365 and hold admin rights, we link your tenant to it by default so your user accounts are imported and matched to devices; you can ask us to switch this off. The management agent on devices on our care plans also provides remote access, patch deployment and the ability to run scripts, so during support work a technician can see and control the device | United States | United States | International Data Transfer Addendum |
| Splashtop Inc. | The remote access connector built into Syncro, used for remote support sessions on Customer devices. Each connection is logged; sessions are not recorded | United States | United States, with connections relayed through regional servers | Engaged through Syncro. Splashtop’s own terms use the UK Addendum to the Standard Contractual Clauses |
| ISL Online (ISL Remote d.o.o.) | Remote access used to deliver support, and the live chat on our website. During a remote session the technician can see and control the device, so anything displayed on it may be visible | Slovenia (part of PDQ.com Corporation, United States) | European Union for account data. Session details may be routed through ISL’s servers worldwide; session content is end-to-end encrypted and ISL does not hold the keys | Covered by UK adequacy (EU); ISL’s Standard Contractual Clauses for any routing outside the EU |
| Anthropic PBC | AI assistance in service delivery and automation — see below | United States | United States | International Data Transfer Addendum |
Connectivity
| Subprocessor | What they do for us | Entity location | Where your data is held | Transfer safeguard |
|---|---|---|---|---|
| Zen Internet Ltd | Broadband and connectivity; hosted telephony and VoIP, including the Uboss telephony platform, which holds call records and voicemail and transcribes voicemail messages | United Kingdom | United Kingdom | Not applicable — UK |
| Plasma Cloud Ltd | Cloud management of WiFi networks and guest access systems we install, including guest login details and connection records | Hong Kong | United States (confirmed by Plasma Cloud, November 2026) | Data processing terms with UK transfer clauses requested from the supplier (November 2026) and under review by its legal team. The data held is limited to device identifiers, connection records and any details entered on a guest login page |
| EE Ltd | Mobile data services | United Kingdom | United Kingdom | Not applicable — UK |
| Unity World Ltd | Provisions, bills and supports the O2 mobile SIMs and tariffs we supply. Holds the customer and connection details needed to do so | United Kingdom | United Kingdom | Not applicable — UK |
| Telefónica UK Ltd (O2) | Operates the mobile network carrying those services | United Kingdom | United Kingdom | Not applicable — UK |
A note on how carriers sit. The suppliers in this section have two roles at once. They act as our subprocessors for the customer and order details we pass to them to provision and support a service. They also act as controllers in their own right for the records their networks generate, because they hold those to run and bill for the service and to meet obligations placed on them as communications providers. We have listed them here for completeness, but where they act as controllers our Data Processing Agreement does not govern what they do.
Where we supply a telephony, mobile or broadband service, the carrier delivering it necessarily holds records of the service’s use — for telephony and mobile, that includes the numbers called, the time and the duration. Carriers hold this data to provide and bill for the service and to meet their own legal obligations as communications providers, and in doing so they act in their own right rather than only on our instructions. We see this data where we need it to bill you or investigate a fault.
Our use of AI
We think customers should be told plainly when AI is part of how a service is delivered, so here is our position.
We use Anthropic’s Claude to help us run our service desk, analyse our systems, produce reports and automate routine work. It genuinely improves what a small team can deliver, and we would rather describe it openly than leave it for someone to discover in a questionnaire.
What it can access:
- Our service desk system, which holds your contact details, the content of support requests (including voicemail transcripts) and your device inventory
- Our accounting system, which holds your billing contact details and invoice history. We hold those records as a business in our own right rather than on your behalf — see “Not subprocessors” below
- Our hosting control panel and server management tools — configuration, domain and site settings, server logs
- Our DNS management
- PCQ’s own Microsoft 365 tenant — our own mail and files
What it cannot access:
- Your Microsoft 365 tenant
- Your mailboxes, files or documents
- Password vault contents
- Your backups
One thing we will not overstate. Hosting control panel access carries with it the technical ability to reach the databases behind hosted sites. We do not use AI assistance for that and do not direct it there, but the restriction is one of practice rather than something the access level makes impossible, and we would rather say so than claim a boundary that is not really there.
One distinction worth drawing out. Our service desk platform can, in a technician’s hands, open a remote session to a managed device or run a script on it. The AI assistant cannot. It is able to read and update records — tickets, assets, contacts, invoices — and it has no ability to start a remote session, take control of a device, or run anything on your computers.
On our hosting platform it can carry out actions that change a hosted site, such as updating website software or changing files, but only after a PCQ technician has reviewed and approved each action. A person signs off every change, and a person remains accountable for it.
Training. Personal data processed this way is not used to train Anthropic’s models. We have model training disabled on the account used to deliver our services.
Human oversight. Changes to your systems are made or approved by a person. We do not let AI tooling make unsupervised changes to customer environments.
If you would prefer we did not use AI assistance in delivering your services, tell us and we will discuss what that means for the services you take.
Not subprocessors
For completeness, these are suppliers we use to run our own business rather than to process your data on your behalf. They appear in our Privacy Notice instead.
- Xero — our accounting system
- Our bank and payment providers — HSBC, Eazy Collect (Direct Debit), PayPal and EVO Payments (card payments), collecting payments due to us. They handle our billing data, where we are the controller, not data we process for you
- EmailOctopus (Three Hearts Digital Ltd, UK) — the email service we use to send announcements and updates to our own customers and to people who sign up on our website. It holds our contact list, where we are the controller, not data we process for you
- Our professional advisers — accountants, insurers and similar
Questions
If you have a question about anything on this page, or you need information for your own subprocessor register or supplier assurance process, contact us at [email protected] and we will answer it.
Previous versions
| Version | Date | Change |
|---|---|---|
| 1.3 | 10 November 2026 | Completed the remaining entity, location and safeguard details for ISL Online, Imunify360, KnowBe4, Keeper, 1Password, Livedrive and Plasma Cloud, including Plasma Cloud’s confirmed data location. Added EmailOctopus under “Not subprocessors”. Clarified the wording on Acronis’s own subprocessors and on human oversight of AI tooling. No new subprocessor was engaged. |
| 1.2 | 7 November 2026 | Added Splashtop, the remote access connector built into Syncro, which was already in use but not listed separately. |
| 1.1 | 6 November 2026 | Added Octiga, Plasma Cloud and Livedrive, which were already in use but missing from version 1.0. Updated the descriptions for Keeper, ISL Online and Zen Internet. Clarified what the AI assistant can do on our hosting platform. |
| 1.0 | 1 November 2026 | First published |
Questions about any of this?
If something here affects you and is not clear, ask us. We would rather explain it than have you guess.