Sub-processor Schedule
Referenced from the Data Processing Agreement
Version 1.0 · June 2026
- →All third-party services that process Client Data on WELX's behalf
- →What each sub-processor does and where data is held
- →The transfer mechanism used where data leaves the UK or EEA
- →How and when this schedule is updated
This schedule lists the sub-processors currently used by WELX to process Client Data. It is incorporated into and forms part of the Data Processing Agreement. WELX will give 30 days notice of any addition to or change in this schedule, during which time a Subscriber may object on reasonable grounds related to data protection.
Current Sub-processors
| Sub-processor | Role and data processed | Data location | Transfer mechanism |
|---|---|---|---|
| Supabase | Database and authentication. Stores Client Data including client records, session notes, booking history, and Subscriber account data. | London, UK (EU region) | No transfer, UK-hosted |
| Stripe | Payment processing for Subscriber subscriptions. Processes Subscriber billing data only. Does not receive Client Data. | EU (Stripe Technology Europe, Ireland); US transfers may occur | UK-US Data Bridge / IDTA where applicable; Stripe DPA in place |
| Resend | Transactional email delivery to Subscribers and their clients. Processes Subscriber and client email addresses and names for booking confirmations, payment notifications, and engagement messages. Resend processes Client Data. | US-based; EU sending region available | UK-US Data Bridge (UK Extension to EU-US DPF); IDTA fallback. Applies to both Subscriber and Client Data. |
| Netlify | Hosting, serverless functions, and CDN. Processes requests to and from the platform. | US-based (configurable); EU region available | UK-US Data Bridge (UK Extension to EU-US DPF); IDTA fallback |
| Plausible Analytics | Privacy-preserving website analytics. Cookieless. Processes no personal data and no Client Data. | EU-hosted | No personal data processed, not a data processor for GDPR purposes |
Google Search Console and Bing Webmaster Tools are used for search performance analytics on the WELX marketing site only. They process no personal data and no Client Data and are not sub-processors for the purposes of this DPA.
International Transfers, Notes
Supabase Data is hosted in Supabase's London region. No international transfer of Client Data occurs. This is the primary database for the platform and is the cleanest position for UK data residency.
Stripe Stripe Technology Europe (Ireland) is the contracting entity for EU/UK customers. Some data may transfer to the US. The UK-US Data Bridge applies where Stripe holds current UK Extension certification. WELX has executed Stripe's standard Data Processing Agreement. Subscribers should verify Stripe's current DPF certification status at dataprivacyframework.gov if this is material to their compliance position.
Resend Resend's account data is US-based. Resend processes both Subscriber and Client Data, client email addresses and names are transmitted to Resend for booking confirmations, payment notifications, and engagement messages. WELX relies on the UK-US Data Bridge (UK Extension to the EU-US DPF) for all UK personal data transferred to Resend, including Client Data. Where certification cannot be confirmed, the IDTA applies as fallback. Subscribers should note that this means their clients' email addresses and names are processed by a US-based sub-processor, and this should be reflected in the Subscriber's own privacy notice to their clients.
Netlify Netlify's default function region is US-based. WELX relies on the UK-US Data Bridge for any UK personal data processed by Netlify functions. EU region configuration is available and may be used in future. Netlify does not store Client Data, it routes requests to Supabase.
Transfer Mechanism Notes
UK-US Data Bridge the UK Extension to the EU-US Data Privacy Framework, in effect since 12 October 2023, permits restricted transfers of UK personal data to US firms that are specifically self-certified under the UK Extension. Certification under the base EU-US DPF alone is not sufficient. WELX verifies certification periodically at dataprivacyframework.gov.
IDTA the International Data Transfer Agreement, published by the ICO, is used as the fallback transfer mechanism where a sub-processor does not hold current UK Extension certification.
For EU-based Subscribers the EU-US DPF and Standard Contractual Clauses apply in place of the UK-US Data Bridge and IDTA respectively. The EU-US DPF and the UK Extension are separate certifications; WELX verifies both where EU Subscribers are served.
Schedule Version and Update Process
This schedule is version-controlled. The current version is displayed at the top of this document. When WELX adds or changes a sub-processor, the following process applies:
WELX publishes an updated schedule and notifies all active Subscribers by email at least 30 days before the change takes effect.
A Subscriber who objects to the change on reasonable data protection grounds may notify WELX in writing within the 30-day period. WELX will engage in good faith to address the concern.
If the concern cannot be resolved and the Subscriber does not wish to continue on the new terms, the Subscriber may terminate their subscription without penalty, and any unused portion of the current billing period will be refunded.
If no objection is received within 30 days, the updated schedule takes effect and the new sub-processor is authorised.
Entity note: these documents are issued by Maklain Partners Limited, a company registered in England and Wales under company number 17381124 and VAT registration number 527 6816 63 (registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ), which trades as WELX. The updated documents will be version-incremented and presented for acceptance at public launch.
Solicitor review recommended before public launch, particularly on the special-category data prohibition and its enforcement mechanism, the Stripe Connect liability position, and confirmation of UK Extension certification for each US-based sub-processor.