Sub-processor List — QuietStaff Ltd
What this list is
QuietStaff Ltd (Co. No. 17171308) acts as a Data Processor under UK GDPR for our Customers' personal data. To deliver the Services, we engage the Sub-processors listed below. Each Sub-processor is bound by a written Data Processing Agreement that imposes data-protection obligations no less onerous than those we owe to our Customers.
This list operates in conjunction with our Privacy Policy and forms part of every signed QuietStaff Data Processing Agreement (DPA). Customer authorisation under the Sub-Processors clause of the DPA covers every Sub-processor on this list as at the date of signature. We give Customers at least 30 days' prior written notice of the addition of any new Sub-processor.
Current Sub-processors
| # | Sub-processor | Purpose | Region | Transfer mechanism |
|---|---|---|---|---|
| 1 | Amazon Web Services EMEA SARL | Cloud infrastructure and storage of Customer Personal Data, including AWS Bedrock access to AI foundation models | London (eu-west-2) | UK / EU — no Restricted Transfer |
| 2 | Google LLC (Google Workspace) | Email, document storage, calendar — incidental Customer Personal Data when Customer corresponds with QuietStaff | EU multi-region with global routing | EU Standard Contractual Clauses + UK International Data Transfer Addendum (per Google's standard DPA) |
Sub-processors not currently engaged but contemplated
When the following are activated, this page will be updated and Customers notified at least 30 days in advance:
- Anthropic, PBC (direct API) — listed in v1.0 (1 May 2026) and removed in v1.1. Customer-instructed access to Claude models is delivered via AWS Bedrock (in the AWS sub-processor entry above) rather than the Anthropic direct API. Bedrock cross-region inference is disabled by default; live Customer Personal Data is processed only in dedicated client AWS accounts in eu-west-2 (London). The Anthropic direct API will only be re-introduced as a Sub-processor if and when a specific Customer engagement requires it, with prior notice under the change-notification process below.
- Pipedrive (Pipedrive Inc.) — CRM / sales pipeline management — engagement pending JD posting + first agent hire (currently expected Q3 2026). EU/Frankfurt region intended.
What is NOT a Sub-processor
The following providers are used by QuietStaff for our own internal operations and do not process Customer Personal Data on Customer's behalf, and are therefore not Sub-processors under UK GDPR Article 28:
- Banking providers (Tide, Wise) — process QuietStaff's own financial data only
- Internal accounting / payroll providers — process QuietStaff staff data only
Change-notification process
For each material change to this list (addition or removal of a Sub-processor):
- The change is staged at least 30 days before going live
- All current Customers are notified by email to the address registered on their signed DPA
- The change appears on this page with a
(NEW — added YYYY-MM-DD)marker for 60 days - Customers retain the right to object under the Sub-Processors clause of their signed DPA
Snapshot retention
For every signed Customer DPA, QuietStaff retains a snapshot of this page as it existed at the date of execution. This snapshot is available to the relevant Customer on request as evidence of their authorisation.
Contact
Questions about this list, change notifications, or to record an objection:
privacy@quietstaff.com
QuietStaff Ltd, 66 Paul Street, London, EC2A 4NE, United Kingdom
ICO registration: ZC130484