Legal
Service Providers and Sub-processors
This page lists the providers WREN TECHNOLOGIES LTD (“Wren”, “we”, “us”) uses to operate our services, and explains the difference between a provider that supports us as controller and one that supports us as processor for a customer.
1. Scope and roles
We are a controller of our own business database, directories, accounts and marketing. Where a provider processes information for those activities on our behalf, it acts as our processor (sometimes described as a “sub-processor” of us). Where a provider instead processes information a customer has given us solely on that customer’s instructions — for example, a Pulse upload — it acts as a sub-processor of that customer, engaged under our Customer Data Processing Agreement.
A provider can hold more than one role depending on the activity, and some providers are also independent controllers of their own account, transaction or security information, under their own privacy notice. The table below states the purpose each provider serves; it does not itself determine the applicable role for a specific piece of data — see our Privacy and Fair Processing Notice for that.
2. Current providers
| Provider | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Microsoft Azure | Database hosting (UK West, replicated to UK South), database backups, file storage (Pulse uploads, export files), Azure Communication Services (transactional email), and GPU compute running Wren’s own AI models for website chat, the inbound receptionist and outbound verification calling | UK West / UK South for database, storage, transactional email and AI compute. Wren uses UK Azure data centres only for these services. Microsoft states that Azure regional services deployed in an EU Data Boundary region are in scope for the EU Data Boundary, subject to documented limited transfers | Governed by Microsoft’s standard cloud terms and the Microsoft Products and Services Data Protection Addendum. For personal data transferred outside the UK/EEA/Switzerland, Microsoft states that it uses appropriate safeguards including SCCs and the Data Privacy Framework where applicable |
| SMTP2GO | Transactional and application email sent from the Wren application, and delivery of contact-form notification emails from the wren-data.co.uk website. A submission made through the website contact form is emailed to our enquiries inbox, so the message content, the sender’s name, email address, any company name given and the enquiry topic pass through SMTP2GO. Not used for customer campaign data or customer email-campaign sending | Wren’s account is hosted in SMTP2GO’s EU data centre. SMTP2GO states that EU and UK customers can use dedicated EU and UK SMTP/API services, with sending processed by EU and UK based servers only. Wren uses SMTP2GO’s standard activity retention and has not enabled extended Activity Storage Duration or Email Archiving | Governed by SMTP2GO’s Data Processing Agreement. SMTP2GO states that it takes safeguards for processing outside the EEA where applicable |
| Stripe | Payment processing, subscription billing, invoice generation | Stripe is a global payment processor. Stripe states that personal data may be transferred to, and processed in, countries where Stripe, its service providers or relevant payment-method partners operate, including the United States | Governed by Stripe’s standard services terms, Data Processing Agreement and data transfer terms. Stripe states that it uses transfer mechanisms including adequacy decisions, the EU-U.S. Data Privacy Framework with UK Extension, SCCs and the UK Addendum where applicable |
| Datadog | Monitoring and observability of our infrastructure | Wren uses the Datadog EU site. Datadog states that personal data may be transferred to and processed in countries where Datadog or its service providers operate, including the United States. Datadog’s public subprocessor list identifies third-party subprocessors and countries | Governed by Datadog’s standard DPA/account terms. Datadog’s DPA incorporates SCCs and the UK Transfer Addendum for restricted transfers from the UK |
| Instiller | Email-campaign delivery and open/click measurement | UK data centres. Instiller publishes infrastructure information stating that data is stored within its data centres, with encryption in transit and at rest | Governed by Instiller’s standard terms, including its data processing terms |
| Google Analytics and Google Ads | Optional website and app analytics and advertising measurement, used only after cookie-banner consent. Google Signals is not enabled | Google states that Google Analytics operates as a processor for Analytics customers and that customers control collection, access, retention and deletion settings. Google Analytics and Google Ads measurement may involve international processing, including transfers to the United States | Governed by Google’s standard measurement and data processing terms. Google’s Analytics/Ads data processing terms include transfer mechanisms for restricted transfers, including SCCs and, where adopted, the Data Privacy Framework/UK Extension |
| Cloudflare | Domain/DNS, Pages hosting, web application firewall, Turnstile bot protection and network access services | Cloudflare operates a global network and states in its DPA that Cloudflare and its sub-processors may process certain personal data outside the EEA, Switzerland and the UK in connection with the services | Governed by Cloudflare’s standard account terms and DPA. Cloudflare’s DPA applies SCCs and the UK Addendum for restricted UK transfers, and states that Cloudflare participates in the Data Privacy Framework |
No third-party AI provider. Our website chat, inbound receptionist and outbound verification calling all run AI models that Wren operates itself on Azure GPU compute, listed in the Microsoft Azure row above. Chat messages and call content are not sent to any external AI provider and are not used to train any third party’s model.
Depending on the provider, the information received may include transaction details, technical connection and device information, security events, recipient addresses and engagement events, chat messages, or call content. A full description of what each provider receives is in our Privacy Notice.
2A. Platforms our customers connect
A customer can connect a third-party platform — for example a CRM, marketing or automation tool — and instruct us to write data into it. Where the customer selects the platform, holds the account, grants the access and contracts with its provider directly, that platform is not a Wren sub-processor and is not listed above. It processes data under the customer’s own agreement with its provider. We have no contract with that provider covering the customer’s data, and we do not control what happens to data once it has been written there.
Whether a provider is a sub-processor depends on the actual arrangement, not on how it is labelled. Where we appoint a provider to process Customer Data on our behalf, it appears in the table above. The change-notification process in Section 4 does not apply to them: a customer adding or removing one of their own connected platforms is their decision, not a change to our provider register.
A customer connecting a platform is responsible for its own processor terms and transfer safeguards with that provider. See Section 5A of our Customer Data Processing Agreement.
3. Transfers outside the UK
Our core business database is hosted in the UK. This does not mean every provider’s processing takes place only in the UK. Where a transfer outside the UK is subject to UK international-transfer rules, an appropriate legal route applies: this may be UK adequacy regulations, or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with the required transfer risk assessment.
You can contact us for information about the safeguards relevant to a specific provider, subject to necessary redactions.
4. Change notification
When we add a new sub-processor, or replace an existing one, in a way that materially changes how a customer’s data is processed under our Customer Data Processing Agreement, we will give the affected customer at least 30 days’ notice before the change takes effect. Notice is given by email to the account contact, and by updating this page with the change logged in the version history.
If a customer reasonably objects to a new sub-processor within that notice period, we will work with them in good faith to address the objection — which may mean withdrawing the change, or agreeing that the customer discontinues use of the specific feature that relies on the new sub-processor. Where a feature’s processing is intrinsic to the service (for example, database hosting), it cannot be disabled individually while the customer continues to use the service.
This section applies to our role as processor for customer data. It does not limit changes to providers who support Wren’s own controller activities, which are described in our Privacy Notice and updated there when they change.
5. Contact
Questions about this register, including requests for more detail on a specific provider, can be sent to dpo@wren-data.co.uk.