1What counts as a sub-processor here
A sub-processor is a third party we engage to process personal data on our behalf as part of running Varde. This page lists every one currently in use, where they're based, and how any transfer of your data outside the UK is safeguarded. It's the same list maintained in our internal Record of Processing Activities, kept in step with it rather than duplicated separately.
2Current sub-processors
| Sub-processor | What they process | Location | Transfer safeguard |
|---|---|---|---|
| Anthropic | Claude API — AI processing of assessment, gap report, and policy content | USA (contracting entity: Anthropic Ireland Limited) | EU Standard Contractual Clauses (Module Two/Three) + UK International Data Transfer Addendum (B.1.0) |
| Stripe Payments Europe, Limited | Payment processing, billing, VAT invoicing | Dublin, Ireland (contracting entity); underlying infrastructure extends to the United States | EU SCCs (Module Two/Three) + UK International Data Transfer Addendum (B.1.0) |
| Fasthosts Internet Limited | Outbound email delivery for invitations, account setup, and password reset messages | United Kingdom | Not applicable — UK-based, no international transfer |
| Hosting infrastructure (AWS) | Runs the application and database that store your data (MongoDB self-hosted on the same infrastructure, not a separate managed service) | United Kingdom (London, eu-west-2) |
Not applicable — UK-based, no international transfer |
| Google (Google Analytics 4) | Website usage analytics — only for visitors who accept the analytics cookie banner | United States (and other Google infrastructure locations) | Google Analytics Data Processing Terms: EU SCCs (Module Two/Three) + UK International Data Transfer Addendum (B.1.0) |
Every transfer safeguard above is the same underlying UK transfer mechanism — the "data protection test" now at Article 46(1A) UK GDPR — confirmed directly against each provider's own published data processing agreement, not merely asserted.
3Not sub-processors
The FCA Register, Companies House, and HMRC's VAT Registration Check are queried when your firm registers or updates its profile, to confirm your FCA firm reference number, company number, or VAT number are valid. These checks transmit only the identifier itself — never your name, email, or any other personal data — so we don't treat them as sub-processors.
4Changes to this list
We'll update the date at the top of this page whenever a sub-processor is added, replaced, or removed. If you'd like to hear about a change directly rather than checking back, email privacy@stripyfish.net and we'll let you know when this list next changes — this is a manual notification today, not an automated subscription.
Under our Data Processing Agreement clause 6.1, you have the right to object to a new sub-processor on reasonable data-protection grounds.