Legal

Sub-processors

The third parties that may process personal data on our behalf, what each is used for, and where they process it.

Version: 1.0
Last reviewed: 7 August 2026
Governing law: England and Wales

These are the third parties that may process personal data on our behalf. This list is referenced by our Data Processing Agreement and our Privacy Policy, and it is the mechanism by which we give you notice of changes.

Change Notification

We will give at least 30 days' written notice before adding a new sub-processor that will process your personal data, or replacing an existing one. During that period you may object on reasonable data protection grounds; if we cannot resolve your objection, you may terminate the affected services without penalty. To receive change notices, email privacy@etradersgroup.online and ask to be added to the sub-processor notification list.

Current Sub-Processors

Provider	Purpose	Data processed	Location	Transfer safeguard
Google reCAPTCHA	Detecting automated abuse of public website forms	IP address, browser and device signals, interaction data, and verification token	Global, including the United States	EU SCCs / UK Addendum
Stripe	Card payment processing and invoicing	Billing contact details, transaction data. We never store full card numbers.	United States, EEA	EU SCCs / UK Addendum
Hosting provider	Application and database hosting	All application data	REPLACE — state your region	Data centre in region
Email delivery provider	Transactional email (invoices, notifications)	Name, email address, message content	REPLACE	EU SCCs / UK Addendum
Anthropic	AI model inference during service delivery, where a client engagement uses it	Content submitted for processing. Training disabled on enterprise endpoints.	United States	EU SCCs / UK Addendum
OpenAI	AI model inference during service delivery, where a client engagement uses it	Content submitted for processing. Training disabled on enterprise endpoints.	United States	EU SCCs / UK Addendum

Engagement-Specific Sub-Processors

Some sub-processors apply only to particular engagements. AI model providers, for example, are used only where a client's engagement involves them, and always with training disabled and zero or minimal retention configured on enterprise endpoints. Manufacturing and sampling partners apply only to apparel engagements. Where an engagement introduces a sub-processor not listed above, we identify it in the statement of work before you sign, rather than adding it silently.

How We Assess Them

Before appointing a sub-processor we review its security posture and certifications, its data residency and transfer mechanisms, its own sub-processor chain, its breach notification commitments, and its deletion guarantees. Each one is bound by a written contract imposing data protection obligations no less protective than those in our own Data Processing Agreement, and we remain fully liable to you for their performance.

Parties That Are Not Sub-Processors

For completeness: our professional advisers (accountants, auditors, lawyers) act as independent controllers under their own professional obligations, not as our sub-processors. Where you instruct us to integrate a system you already control — your CRM, your applicant tracking system, your cloud tenancy — that provider is your sub-processor, not ours.