Sub-processor List — QuietStaff Ltd
What this list is
QuietStaff Ltd (Co. No. 17171308) acts as a Data Processor under UK GDPR for our Customers' personal data. To deliver the Services, we engage the Sub-processors listed below. Each Sub-processor is bound by a written Data Processing Agreement that imposes data-protection obligations no less onerous than those we owe to our Customers.
This list operates in conjunction with our Privacy Policy and forms part of every QuietStaff Data Processing Agreement (DPA), whether signed or, for QuietDesk, accepted at Checkout. Customer authorisation under the Sub-processors clause of the DPA covers every Sub-processor on this list for the relevant service, as at the date the DPA was signed or accepted. We give Customers at least 30 days' prior written notice of the addition of any new Sub-processor.
Current Sub-processors
| # | Sub-processor | Purpose | Region | Transfer mechanism |
|---|---|---|---|---|
| 1 | Amazon Web Services EMEA SARL | Cloud infrastructure and storage of Customer Personal Data for our consulting engagements, including access to AI foundation models. Not used for QuietDesk. | London (eu-west-2) | UK / EU — no Restricted Transfer |
| 2 | Google LLC (Google Workspace) | Email, document storage, calendar — incidental Customer Personal Data when Customer corresponds with QuietStaff | EU multi-region with global routing | EU Standard Contractual Clauses + UK International Data Transfer Addendum (per Google's standard DPA) |
| 3 | Cloudflare, Inc. | Website enquiry delivery — contact-form requests are handled by a Cloudflare Worker and forwarded by Cloudflare Email Routing to our mailbox | EU/UK edge; US-headquartered | EU Standard Contractual Clauses + UK International Data Transfer Addendum (per Cloudflare's standard DPA) |
QuietDesk sub-processors
QuietDesk is our enquiry-handling service for heating and plumbing firms. The Sub-processors below process personal data for firms that use QuietDesk. The table above covers our other Services and does not apply to QuietDesk.
| Sub-processor | Purpose | Region | Transfer mechanism |
|---|---|---|---|
| Anthropic (Claude API, called directly) | Writes replies in the chat and to enquiry emails. Receives the text of chat and email messages and the firm's knowledge text. | Not yet confirmed. US-headquartered. | Not yet confirmed. |
| Resend | Sends QuietDesk email: emails to a firm's customers, and alerts and lead summaries to the firm. Receives recipient email addresses and message text. | Not yet confirmed. US-headquartered. | Not yet confirmed. |
| Stripe | Billing and Checkout for firms that subscribe. Collects the firm's business name, email address and card details, and holds the card. | Not yet confirmed. US-headquartered. | Not yet confirmed. |
| Cloudflare | Hosting (Workers), the database that holds enquiry data (D1), short-lived session data and lead copies (KV), receiving forwarded enquiry email (Email Routing), and the browser check on the chat and the enquiry form (Turnstile, which receives the visitor's IP address). | Not yet confirmed for QuietDesk. US-headquartered. | Not yet confirmed for QuietDesk. |
QuietDesk uses no other Sub-processor. Any addition is made under the change-notification process below.
Sub-processors not currently engaged but contemplated
When the following are activated, this page will be updated and Customers notified at least 30 days in advance:
- Pipedrive (Pipedrive Inc.) — CRM / sales pipeline management — engagement pending JD posting + first agent hire (currently expected Q4 2026). EU/Frankfurt region intended.
What is NOT a Sub-processor
The following providers are used by QuietStaff for our own internal operations and do not process Customer Personal Data on Customer's behalf, and are therefore not Sub-processors under UK GDPR Article 28:
- Banking providers (Tide, Wise) — process QuietStaff's own financial data only
- Internal accounting / payroll providers — process QuietStaff staff data only
Change-notification process
For each material change to this list (addition or removal of a Sub-processor):
- The change is staged at least 30 days before going live
- All current Customers are notified by email to the address registered on their signed DPA
- The change appears on this page with a
(NEW — added YYYY-MM-DD)marker for 60 days - Customers retain the right to object under the Sub-Processors clause of their signed DPA
Snapshot retention
For every signed Customer DPA, QuietStaff retains a snapshot of this page as it existed at the date of execution. This snapshot is available to the relevant Customer on request as evidence of their authorisation.
Contact
Questions about this list, change notifications, or to record an objection:
privacy@quietstaff.com
QuietStaff Ltd, 66 Paul Street, London, EC2A 4NE, United Kingdom
ICO registration: ZC130484