Skip to main content

Legal · Sub-processors

Sub-processors

Last updated: 6 October 2026. Tamazia Ltd, company number 17295579, registered in England and Wales, registered office 124 City Road, London, EC1V 2NX. This page lists the service providers that process personal data for us. It also covers the Compliance Radar pages on our website, which run on the same systems. Compliance Radar is supplied under its own Radar terms.

Part 1 lists the providers that process personal data we handle for a client under our data processing agreement.

Part 2 lists the providers behind our own website and business. For that data we are the controller, and our privacy notice explains how we use it.

If you are a client and you have given us general written authorisation to use other processors, we tell you about any intended addition or replacement so that you have the opportunity to object. We do this at least 30 days before the change takes effect (clause 9 of our data processing agreement).

Part 1: providers for client work

ProviderLegal entityWhat it does for usPersonal data it receivesWhereWhat covers the transfer
Cloudflare Cloudflare, Inc. Stores the report files we produce (R2) and serves them on our website. Any personal data in our reports, such as names published on your website. Cloudflare's global network. Cloudflare, Inc. is in the United States. UK Extension to the EU-US Data Privacy Framework. EU standard contractual clauses with the UK Addendum also form part of Cloudflare's data processing addendum.
Neon Databricks, Inc., the parent company of Neon, LLC The database behind our reports. Every report is opened through it. For each report: the firm's name and website address and the link to our record of the firm. For older reports, the whole report, including any personal data in it, such as names published on your website. Germany (Frankfurt) Storage in Germany: UK adequacy regulations for the European Economic Area. For any access from outside the European Economic Area: the UK Addendum to the EU standard contractual clauses in the Databricks data processing addendum, which governs Neon.

Part 2: providers for our own website and business

ProviderLegal entityWhat it does for usPersonal data it receivesWhereWhat covers the transfer
Cloudflare Cloudflare, Inc. Hosts our website and the functions behind our forms. Stores form, booking and unsubscribe records (Workers KV) and report files (R2). Checks forms for bots (Turnstile). Counts page loads without cookies (Web Analytics). Controls sign-in to our admin area (Access). Cloudflare sees the full IP address of everyone who visits our website. It stores for us: everything typed into our forms (such as name, email address, company, sector, website and message), with a shortened IP address, country, browser details and the page the form was sent from; booking records (the name and email address of each person booked, their time zones, the meeting type, start and end times, the booking details sent with them, which can include answers to the booking questions); requests made through our older website review tool (email address, the website reviewed, the result, browser details and the IP address, with the last block removed from an IPv4 address but an IPv6 address kept whole); for anyone who uses the unsubscribe link in our outreach emails, their email address, full IP address, browser details and the address the email came from; a one-way hash of the email address for other unsubscribes and in our log of erasure requests; if the email confirming an erasure fails to send, a retry record holding the first 16 characters of the email address; reports of failed connections sent by browsers, kept for 30 days with the country and a shortened IP address (an IPv6 address keeps all but its last block); report files. Cloudflare's global network. Cloudflare, Inc. is in the United States. UK Extension to the EU-US Data Privacy Framework. EU standard contractual clauses with the UK Addendum also form part of Cloudflare's data processing addendum.
Google (Gmail) Google LLC A personal Gmail account that receives the alerts our website sends us. Google offers no data processing terms for a personal Gmail account, so it is not bound to us as a processor. Everything typed into our forms, including Compliance Radar requests. Requests to see, export or erase data, with the email address. Booking alerts, with name, email address and meeting time. Payment alerts, with name or email address. Google LLC is in the United States. UK Extension to the EU-US Data Privacy Framework (Google LLC).
Resend Plus Five Five, Inc. (trading as Resend) Sends our emails: acknowledgements of enquiries and Compliance Radar requests, alerts to us, and emails about access, export and erasure requests. Email address and name of the person we write to, the content of the email, and the request reference. Alerts to us contain the full form content. United States UK Extension to the EU-US Data Privacy Framework. EU standard contractual clauses with the UK Addendum in Resend's data processing agreement.
Neon Databricks, Inc., the parent company of Neon, LLC Our main database. Enquiries and other form submissions: name, email address, company, message, page address, campaign tags, request reference and, where set up, a salted one-way hash of the IP address. Our list of firms and contacts for outreach (leads): contact name, email address, company, sector and website. A record of each outreach email we send (sends): recipient, subject, sending server, delivery status, and when it was opened or replied to. Replies we receive, with their text, and our drafts and follow-up stages. Our do-not-email list (suppression). Report records: the firm's name and website address, the link to our record of the firm, how often the report was opened and, for older reports, the whole report. Requests made from our report pages: firm name, website, the details given, country and browser. Orders made through old payment links: customer email address, company and what was bought. Compliance Radar subscriptions: customer email address, website, the sectors and markets chosen and the amount. Booking records: name, email address, meeting type and times. Client accounts, invoices and onboarding tasks. Germany (Frankfurt) Storage in Germany: UK adequacy regulations for the European Economic Area. For any access from outside the European Economic Area: the UK Addendum to the EU standard contractual clauses in the Databricks data processing addendum, which governs Neon.
PostHog PostHog, Inc. Product analytics. In the browser, only after you switch Analytics on: pages viewed, clicks, form start and submit events, a browser identifier, and the email address when a form is sent. From our server, whatever your cookie choice: when a form is sent, the email address as an identifier, the website address given, the sector and the request reference; when a call is booked, the email address as an identifier, where the booking came from and the meeting time; when a Compliance Radar plan is paid for, the email address as an identifier, the sectors and markets chosen and the amount; when a report is opened, the firm's website address, the report reference, the sector and the country. Germany (PostHog EU cloud, Frankfurt) Storage in Germany: UK adequacy regulations for the European Economic Area. For any access from the United States: the UK Addendum to the EU standard contractual clauses in PostHog's data processing agreement.
Google Analytics 4 Google Ireland Limited Counts visits and pages read. Runs only after you switch Analytics on. A browser identifier, pages viewed, device and browser details, and approximate location. Any country where Google or its sub-processors have facilities, including the United States. Standard contractual clauses in Google's data processing terms. For processing by Google LLC in the United States, the UK Extension to the EU-US Data Privacy Framework (Google LLC).
Cal.com Cal.com, Inc. Booking calls with us: the calendar embedded on our booking and contact pages and on audit report pages. Name, email address, time zone, answers to the booking questions, and the meeting type and time. The embedded calendar sets its own cookies, which our cookie policy describes. United States UK Extension to the EU-US Data Privacy Framework, and EU standard contractual clauses, as stated in the provider's privacy policy.
Stripe Stripe Payments UK Ltd and Stripe Payments Europe, Limited; Stripe, LLC for processing in the United States Takes payments. Stripe also acts as a controller for some of this data under its own terms. Name, email address, billing details, payment card details (entered on Stripe's own page, never stored by us), what was bought, the company name and, for Compliance Radar, the website, sectors and markets chosen. United Kingdom, Ireland and the United States UK Extension to the EU-US Data Privacy Framework (Stripe, LLC). The UK International Data Transfer Addendum in Stripe's data transfer terms.
Hunter Hunter Web Services, Inc. Our website sends it each email address typed into our forms, asking whether the address can receive email, when NeverBounce gives no answer. The email address. Belgium (stored in the European Union) Storage in Belgium: UK adequacy regulations for the European Economic Area. EU standard contractual clauses with the UK International Data Transfer Addendum, in Hunter's data processing agreement.
NeverBounce NeverBounce, a ZoomInfo company Our website sends it each email address typed into our forms, asking whether the address can receive email. The email address. United States We confirm the safeguard for this transfer on request to contact@tamazia.co.uk.
Slack Slack Technologies Limited, Salesforce Tower, 60 R801, North Dock, Dublin, Ireland (a Salesforce company) Our website sends it alerts about new enquiries, bookings, payments and requests to see, export or erase data, for our own workspace. For enquiries: name, company, email address, sector, country, shortened IP address, device type, the page you came from, campaign tags and request reference. For bookings: name, email address, meeting type and time. For payments and requests to see, export or erase data: name or email address. United States Through its parent Salesforce, Slack takes part in the UK Extension to the EU-US Data Privacy Framework. Slack's data processing addendum includes standard contractual clauses.
Telegram Telegram Messenger Inc. Alerts us to new enquiries through the Telegram app. Name, company, email address, sector, country, shortened IP address, device type, the page you came from, campaign tags, request reference, and the first 800 characters of the message. Alerts about bookings, payments and requests to see, export or erase data, with name or email address. Netherlands None. Telegram offers no processor terms.

Google LLC's participation in the UK Extension to the EU-US Data Privacy Framework was checked on the official Data Privacy Framework List on 6 October 2026. The other rows that name the UK Extension rely on each provider's own published terms, linked below.

Each provider's own terms

How transfers out of the UK are covered

A transfer to the European Economic Area is covered by UK adequacy regulations. A transfer to a US organisation that takes part in the UK Extension to the EU-US Data Privacy Framework is covered by UK adequacy regulations. The UK International Data Transfer Agreement (UK IDTA) and the UK International Data Transfer Addendum to the EU standard contractual clauses (the UK Addendum) are standard data protection clauses issued under section 119A of the Data Protection Act 2018.

Notices of changes

To be told before we add or replace a provider, write to contact@tamazia.co.uk with the subject line "Sub-processor notices" and the email address we should use.

Read alongside our data processing agreement, privacy notice and cookie policy.