Legal
Sub-processors
The third-party service providers PerkIQ uses to deliver its platform.
1 About this list
This page lists the third-party services PerkIQ uses. It is published in line with UK GDPR Article 28 transparency requirements and forms part of the PerkIQ Data Processing Agreement (DPA).
It is split into two tables, because the distinction matters to you.
Section 3, Sub-processors. Services engaged to help deliver the platform, which may process personal data PerkIQ holds on behalf of your organisation, including your employees. These are the Sub-processors authorised under the DPA and covered by the change notice below.
Section 4, our own business tools. Services PerkIQ uses to run its own business, where PerkIQ is the data controller. They handle our own contacts, enquiries and website visitors. They receive no employee records, survey responses, benefits data or anything else your organisation enters into the platform. They are listed for transparency, not because they process your data.
Each Sub-processor has been assessed against our security and data-protection requirements. Where a Sub-processor offers a Data Processing Agreement, PerkIQ has one in place.
Browser and device push services are the exception. When an employee turns on notifications, the browser or device decides which push service is used and hands us an address to send to; there is no account, commercial relationship or negotiated agreement between PerkIQ and that service. They are engaged under their published platform terms and receive only the minimised notification content described in section 3.
2 Change notifications
We will give at least 14 days' prior written notice before engaging a new Sub-processor or replacing an existing one. Customers may object on reasonable data protection grounds within that period by contacting info@perkiq.co.uk; where an objection cannot be reasonably addressed the customer may terminate their subscription in line with the DPA.
To receive change notifications by email, write to info@perkiq.co.uk with the subject line “Sub-processor notifications”.
3 Sub-processors
| Sub-processor | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Vercel Inc. | Application hosting, serverless compute, edge network, cron scheduling | All platform traffic (request metadata, IP addresses). No persistent customer data storage. | Ireland (dub1) for serverless function execution; global edge network for static content. Provider is US-incorporated. | UK IDTA + EU SCCs; DPF-certified |
| Supabase Inc. | Primary database (Postgres), authentication, file storage, row-level security | All customer platform data: company details, benefits configuration, survey responses, employee portal records, audit logs | Ireland (AWS eu-west-1) | EU-hosted; no third-country transfer in normal operation |
| Stripe Payments UK, Ltd. | Subscription billing, payment processing, invoicing | Billing contact details, subscription status, card metadata (PerkIQ does not receive full card numbers) | United Kingdom | UK-controlled; any onward transfers to Stripe group entities covered by Stripe's DPA |
| Plus Five Five, Inc. (Resend) | Transactional email delivery (team invitations, employee portal invites, password resets, magic links) | Recipient email address, name where provided, email subject and body content | United States | UK IDTA + EU SCCs; DPF-certified |
| Apple Inc. (APNs) | Push notification delivery to the iOS employee portal app, when an employee turns notifications on | Device push token; the update's title and short description as written by the employer (the same for all recipients; no employee personal data) | United States | Apple developer terms; notification content minimised |
| Google LLC (FCM) / Mozilla (autopush) / Apple Inc. (Web Push) | Web push notification delivery to browsers and the installed portal app, when an employee turns notifications on. The browser selects the service, not PerkIQ: Chrome and Edge (including the Android app) route via Google FCM, Firefox via Mozilla, and Safari and installed iOS web apps via Apple. | Push subscription endpoint and delivery keys; encrypted notification payload | United States / EU edge | Browser vendor terms; payload encrypted end-to-end |
| Upstash, Inc. | Distributed rate limiting (Redis) | Truncated IP addresses and request keys. No PII. | Ireland (AWS eu-west-1); provider entity is US-incorporated | EU-hosted at rest; UK IDTA + EU SCCs with provider as back-stop |
| Functional Software, Inc. (Sentry) | Error tracking and performance monitoring | Error stack traces, request metadata, user ID (UUID only, no email in events) | European Union (Germany, Sentry EU region). Provider is US-incorporated. | EU-hosted at rest; UK IDTA + EU SCCs and DPF certification as back-stop |
4 Our own business tools
These services support PerkIQ's own operations. For each of them PerkIQ is the data controller, not a processor acting for you. None receives employee records, survey responses, benefits configuration or any other data your organisation enters into the platform. They are published here so the picture is complete, not because they process your data.
| Provider | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Calendly LLC | Demo and partner call scheduling, via the booking window on the contact and partners pages | Name, email address and any details entered when booking a call, plus the meeting time. Only for people who choose to book; no platform or employee data. | United States | UK IDTA + EU SCCs; DPF-certified |
| HubSpot, Inc. | Customer relationship management, lead nurturing, account tier synchronisation | Admin user name, email, company name, signup source, signup date, marketing consent status, subscription tier | United States | UK IDTA + EU SCCs; DPF-certified |
| Google LLC (OAuth) | Social authentication, where a user chooses to sign in with a Google account | Account email address and the Google account identifier returned on sign-in. No platform data is sent to Google. | United States | UK IDTA + EU SCCs; DPF-certified |
| Brandfetch SA | Provider and company logo images on the public find-a-provider directory | IP address and browser user agent of visitors whose browser loads a logo image, as with any image served from another domain. No account, platform or employee data. | Switzerland | UK adequacy regulations for Switzerland; no additional transfer mechanism required |
| Google LLC (Google Analytics) | Marketing website analytics (consent-gated; not active on the authenticated platform) | Anonymised page view data, referrer, device class. Only after explicit consent via the cookie banner. | United States | UK IDTA + EU SCCs; DPF-certified |
| PostHog, Inc. | Product analytics (browser events consent-gated via the cookie banner; not active on the employee portal) | Pseudonymous product usage events (account ID, plan tier, feature usage). No survey answers, employee records or message content. | European Union (Frankfurt, AWS) | EU data residency; UK IDTA + EU SCCs |
| Slack Technologies, LLC | Internal operational notifications to PerkIQ staff: new signups, contact form enquiries, billing events and security alerts. | Account holder name, work email address and company name on signup; the name, email address, company and full message body of contact form enquiries; company names and email addresses in billing and renewal alerts. No employee portal records, survey responses or benefits data. | United States | UK IDTA + EU SCCs; DPF-certified |
5 International data transfers
Where a Sub-processor is located outside the United Kingdom, personal data is transferred under one or more of the following safeguards in line with UK GDPR Articles 45-46:
- UK International Data Transfer Addendum (IDTA) appended to the EU Standard Contractual Clauses
- EU-US Data Privacy Framework (DPF), UK Extension, for Sub-processors that are DPF-certified
- Adequacy decisions where the UK has determined the recipient country provides equivalent protection
6 Contact
PerkIQ Ltd
167-169 Great Portland Street, 5th Floor, London, W1W 5PF
Company number: 17102662 · VAT: GB 516 4012 29 · ICO: ZC108098
Email: info@perkiq.co.uk
