Sub-processors
ThisWebDesign Ltd · Effective 28 June 2026
To deliver TWD Platform we use a small number of trusted third-party providers (“sub-processors”) that may process personal data on our behalf. We publish them here for transparency, as referenced in our Privacy Policy and Data Processing Agreement. Each is bound by a written contract requiring it to protect personal data and to process it only as needed to provide its service to us.
| Provider | Purpose | Location | Safeguards |
|---|---|---|---|
| Amazon Web Services (Amazon Web Services EMEA SARL) | Cloud hosting, application database, file and document storage, outbound email delivery, and account identity / sign-in. | United Kingdom (London region, eu-west-2) | Data stored in the UK. AWS Data Processing Addendum; UK IDTA / EU SCCs cover any support access from outside the UK. |
| Stripe (Stripe Payments Europe, Ltd. and Stripe, Inc.) | Card payment processing and billing for paid plans and customer invoices. | European Union and United States | Stripe Data Processing Agreement; EU SCCs with UK Addendum; PCI-DSS Level 1. Card numbers are handled by Stripe and never stored on the platform. |
| Twilio (Twilio Inc.) | Outbound and inbound voice calls and SMS for the Calls module. | United States and European Union | Twilio Data Processing Addendum; EU SCCs with UK Addendum. |
| Microsoft (Microsoft Corporation) | Business email used to receive and answer support correspondence. | European Union / United Kingdom data centres | Microsoft Data Protection Addendum; EU SCCs with UK Addendum. |
| Pax8 (Pax8, Inc.) | Software licence procurement, used by platform administrators only. | United States | Data Processing Agreement; EU SCCs with UK Addendum. Processes operator administrative data only, not workspace or contact personal data. |
| Sherweb (Sherweb Inc.) | Software licence procurement, used by platform administrators only. | Canada | Canada holds a UK adequacy finding for commercial organisations; Data Processing Agreement in place. Processes operator administrative data only. |
Where data is processed
Core platform data (your account, your workspace’s records, files and email processing) is hosted in the United Kingdom. Some sub-processors operate outside the UK; where they do, the transfer is protected by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with the provider’s own data processing agreement. Providers marked as administrative process only our internal operational data, not the personal data you hold about your contacts.
Changes to this list
We may update our sub-processors as the service evolves. Where you process personal data through the platform as a controller, we will give reasonable notice of any new or replacement sub-processor so you can object on reasonable data-protection grounds, as set out in the Data Processing Agreement.
Contact
Questions about our sub-processors? Contact us at privacy@thiswebdesign.co.uk.