1. Scope and changes
COMPLYCLOCK LIMITED, incorporated in England and Wales with company number 17474503. Our registered office is 255-259 2nd Floor West Wing Commercial Road, London, United Kingdom, E1 2BT. Contact us at hello@complyclock.uk.
AWS, OpenAI and Honeybadger process information for the Service. They act as processors for our controller processing, including personal Self Assessment workspaces, and as sub-processors for business Customer personal data processed under the DPA. Stripe and Heart Internet support our own account, billing and communications processing and may handle necessary Customer context in support. Google Analytics is optional and disabled until its separate readiness and consent controls are satisfied. These distinctions matter: not every provider is a sub-processor for every purpose.
We give at least 30 days’ advance email notice of intended additions or replacements of direct Customer-data sub-processors, with the objection process and urgent-change exceptions in the DPA. Supplier downstream sub-processors are governed by their published agreements and notices. We assess changes and applicable transfer safeguards before use.
2. Amazon Web Services
Contracting provider: Amazon Web Services EMEA SARL. Function: application hosting, RDS MySQL, private S3 documents/exports and SES transactional email. Information: workspace records and documents, account and security records, backups, email addresses and message content. Role: processor for our controller records and sub-processor for Customer personal data.
Application, database, S3, SES and their confirmed backup/storage copies are in eu-west-1, Ireland; RDS backups last 30 days and noncurrent S3 documents are eligible for expiry after 35 days. AWS global support or security operations may involve other countries. The AWS Data Processing Addendum is incorporated through its service terms, with applicable SCCs and UK Addendum for restricted transfers. EEA hosting relies on applicable UK adequacy arrangements.
3. OpenAI
Contracting provider for this UK API arrangement: OpenAI OpCo, LLC, United States. Function: requested AI explanations, summaries, setup suggestions and message drafting. Information: feature-specific selected record content and relevant context, potentially including names, deadline/financial facts and correspondence. Role: processor for our personal-workspace controller processing and sub-processor for business Customer data, under the OpenAI DPA.
We use the standard international API service, including US processing, without an agreed EU region or zero-data-retention setup. Requests use store: false. This reduces stored response state but does not remove standard abuse-monitoring retention, normally up to 30 days with legal or specified safety exceptions. API data is not used for training unless the API customer opts in; we do not opt in. The published DPA includes applicable SCCs and UK Addendum.
4. Honeybadger
Provider: Honeybadger Industries LLC, United States. Function: error reporting and operational monitoring. Information: filtered error details, technical request information and necessary internal identifiers; sensitive parameters and credentials are filtered. Role: processor for our security processing and sub-processor where error context includes Customer personal data.
Processing includes the United States. Its published DPA includes SCCs and UK Addendum. Routine errors are subject to our up-to-90-day retention policy; the operator must select and verify account settings that meet that limit, with necessary incident evidence separately justified.
5. Stripe
Providers include Stripe Payments Europe, Limited, Ireland, and Stripe Payments UK Ltd for applicable UK payment services. Function: subscriptions, invoices, payment collection and fraud/regulatory controls. Information: payer/business contact and billing details, subscription metadata and payment details collected directly by Stripe.
Stripe acts as a processor for certain business billing services and as an independent controller for payment processing, fraud prevention and legal obligations. International processing, including the US, is described in Stripe’s Privacy Center and DPA. We use applicable contractual transfer safeguards; Stripe is not given unrestricted access to workspace documents.
6. Heart Internet
Provider: Heart Internet Limited, United Kingdom. Function: hosting the hello@complyclock.uk mailbox. Information: enquiry, support, privacy and incident correspondence, sender/contact details and attachments supplied in those messages. Role: processor for our controller communications; any Customer-data support processing follows the relevant instructions.
Its current hosting terms incorporate its DPA. Mailbox services, support and downstream suppliers may involve international processing; we do not promise Ireland-only or UK-only mailbox processing. Applicable contractual safeguards and destination assessments must cover restricted transfers. Our mailbox cleanup procedure applies the support and legal-evidence retention rules.
7. Google Analytics — optional
Provider: Google Ireland Limited for the UK Analytics agreement, with international processing including the United States. Function: optional public marketing-page measurement. Information: a pseudonymous identifier derived from our signed cookie-preference receipt and sanitised public page views sent by our server. We do not forward visitor IP addresses, browser/device information, private referrers or account identities. It is a processor under the applicable Google Ads Data Processing Terms for Analytics customer data.
Analytics is disabled by default and requires a valid measurement ID, operational enablement and your prior consent. Our strict consent gate sends no Google requests before acceptance, on rejection or after expiry. Server-side Measurement Protocol sends only page views; no Google browser library or automatic engagement collection is loaded. Authentication, workspace and token pages are excluded. Advertising features, Google Signals and enhanced measurement are disabled. Before activation the operator configures two-month event/user retention and disables activity-based retention resets; applicable Google transfer terms and safeguards are reviewed.
8. Independent sources and setup tooling
Companies House supplies public company information under its own public functions and privacy arrangements. Pwned Passwords receives the first five characters of a password’s SHA-1 hash in a padded server-side range query, plus server connection information; it receives no password, complete hash or user email from us. These are independent public/security sources rather than contracted workspace sub-processors.
Hatchbox is used only for infrastructure setup under the owner-confirmed operating arrangement and does not directly process Customer Data. If access, logs, support or deployment use changes that assumption, we must reassess its role and update notices and contractual arrangements before extending use.