Legal / Sub-processors
Sub-processor register
Under UK GDPR Article 28 we keep a public register of every third party that processes personal data on our behalf to deliver our services. This page is updated whenever we add, change or remove one.
What is asub-processor?
A sub-processor is a third-party organisation we engage to process personal data on your behalf. That is different from a supplier whose services do not involve your personal data.
UK GDPR requires us to tell you who they are, obtain your authorisation to use them, and have a data processing agreement in place with each one. We make sure every sub-processor gives sufficient guarantees that it will implement appropriate technical and organisational measures and comply with data protection law.
Current sub-processors
| Provider | Purpose | Data processed | Location and safeguard |
|---|---|---|---|
| MailchimpIntuit Inc. | Email marketing. Sends marketing communications to contacts who have opted in to receive them. | Names, email addresses, email engagement data (opens, clicks). | UKUK SCCs / UK IDTA |
| Vercel Inc.Vercel Inc. | Application hosting. Hosts our internally developed web applications and platforms used to deliver our services. | User account data, platform usage data, performance data processed through hosted applications. | UKData stored in UK, no international transfer |
| Neon Inc.Neon Inc. | Database hosting. Provides the database infrastructure for our internally developed applications. | User account data, platform usage data and application data stored within our hosted databases. | UKData stored in UK, no international transfer |
| Resend Inc.Resend Inc. | Transactional email. Delivers automated emails such as account confirmations and notifications from our internally developed applications. | Names, email addresses and the content of transactional email messages. | USADPA in place, UK SCCs |
| Xero LtdXero Limited | Accounting and invoicing. Manages our financial records, raises invoices and tracks payments from customers. | Business names, contact names, billing addresses, invoice values and payment status. | UK / NZDPA in place, UK SCCs |
| Stripe Inc.Stripe Payments Europe Ltd | Payment processing. We do not store payment card data; all card data is handled directly by Stripe's PCI-compliant systems. | Names, email addresses, billing addresses, transaction amounts and payment status. Card details are processed by Stripe only. | USA / EUDPA in place, UK SCCs |
| GranolaGranola Labs Ltd / Granola, Inc. | AI call transcription. Transcribes calls for internal note-taking; audio is deleted once transcribed and is not stored. Participants are told at the start of any transcribed call and may ask for it to stop. | Call transcripts, AI-generated meeting notes, names and email addresses of call participants. | USADPA in place, EU SCCs and UK Addendum |
| ElevenLabs Inc.ElevenLabs Inc. | AI voice generation. Powers voice-based AI characters and interactions across our ESC, SHIFT, CMD, CTRL+Vish and SPACE_ products. Voice content is generated in real time as part of the training experience. | Scenario scripts, voice prompts and text inputs used to generate AI voice responses during training experiences. | USADPA in place, UK SCCs |
| Twilio Inc.Twilio Inc. | Telephone call infrastructure. Enables the voice-based AI interactions delivered through ElevenLabs across our ESC, SHIFT, CMD, CTRL+Vish and SPACE_ products. | Phone numbers, call metadata and call audio associated with AI-powered voice interactions in training experiences. | USADPA in place, UK SCCs |
| Anthropic PBCAnthropic PBC | AI processing. Generates behavioural analysis reports, scores call transcripts and produces debrief reports across Instinct Lab, CTRL+Vish, CMD and SHIFT. Anthropic does not use API data to train its models. | Survey responses, behavioural scores, call transcripts, participant role and session data required to generate AI-produced reports and scoring outputs. | USADPA in place, UK SCCs |
| Pusher LtdPusher (Bird BV) | Real-time messaging. Powers live in-session communications in CMD: player inboxes, poll delivery, metric updates, countdown timers and session state across participant devices. | Player inbox content, poll questions and responses, session metrics and real-time session state data. | EU (Ireland)DPA in place, UK SCCs |
| Vercel BlobVercel Inc. | Audio file storage. Stores AI-generated voice note audio used in CMD sessions. Separate from Vercel's application hosting. | Audio files containing AI-generated voice content delivered to participants during CMD sessions. | UK (London region)Data stored in UK, no international transfer |
| Microsoft CorporationMicrosoft Corporation | Email, calendar and productivity services (Microsoft 365). Hosts our business email and associated data, accessed directly and via the Microsoft Graph API into Function, our internal business management platform. | Names, email addresses and contact details, and the content of emails, calendar entries and attachments, which may include personal data relating to customers, prospects, participants and suppliers. | UKTenant data stored in UK, DPA in place, UK SCCs |
Ourobligations
- We enter into a data processing agreement with each sub-processor, requiring appropriate technical and organisational security measures.
- We engage sub-processors only for specific, limited purposes directly related to delivering our services, never for their own commercial benefit.
- Where personal data leaves the UK or EEA we put transfer safeguards in place: Standard Contractual Clauses or a UK International Data Transfer Agreement.
- We remain fully liable to you for the performance of any sub-processor we engage.
- We give at least 10 days' written notice before adding or replacing a sub-processor, so you can object.
Changes tothis register
We review and update this register whenever a sub-processor is added, replaced or removed. Customers with active contracts or Data Processing Agreements receive written notice at least 10 days in advance and may object in writing within 10 days of receiving it, as set out in our Data Processing Agreement.
Questions about a specific sub-processor, or to request our Data Processing Agreement: legal@cyberescaperoom.co.
- Company
- The Cyber Escape Room Co. Ltd
- Registered no.
- 13753868
- ICO ref.
- ZC074478
- Address
- Queensgate House, 23 North Park Road, Harrogate, HG1 5PD
- Legal queries
- legal@cyberescaperoom.co