Sub-Processor List

Where Henderson Web processes personal data on behalf of a client (for example hosting a client's website, handling form submissions or sending messages), we use the third-party providers below as sub-processors. This list supports Schedule 1 (the Data Processing Schedule) of our Terms & Conditions. We will give clients reasonable notice of any material change.

Current sub-processors

Vercel Purpose: website hosting, content delivery and infrastructure. Processing location: USA and global edge network, with UK/EU data-protection safeguards.

Supabase Purpose: database, authentication and file storage for the portal, tools and client data. Processing location: EU/UK region.

Resend Purpose: outbound transactional email delivery, such as enquiry confirmations and notifications. Processing location: EU (Ireland).

GoCardless Purpose: Direct Debit mandate setup and recurring payment processing. Processing location: UK and EU.

Stripe Purpose: card payment processing for upfront and one-off payments. Processing location: USA and EU, with appropriate safeguards. Stripe acts as an independent controller for payment and fraud-prevention purposes.

Google (Analytics and Workspace) Purpose: website analytics on hendersonweb.co.uk where the visitor has accepted analytics cookies, and business email. Processing location: USA and global, with appropriate safeguards.

Microsoft (Clarity) Purpose: anonymised website usage analytics on hendersonweb.co.uk where the visitor has accepted analytics cookies. Processing location: USA and global, with appropriate safeguards.

Twilio Purpose: outbound SMS notifications, where enabled. Processing location: USA and global, with appropriate safeguards.

Fasthosts Purpose: domain registration and DNS, where we manage these for a client. Processing location: UK.

Notes

Each sub-processor is engaged under terms that require appropriate security and data-protection obligations. Where a provider processes personal data outside the UK, we rely on an appropriate transfer mechanism, such as UK adequacy regulations or approved contractual safeguards.

If you are a client and would like to object to a new sub-processor on reasonable data-protection grounds, please contact us using the details on our Contact page.