Sub-processors
Version 1.0 - last updated 29 August 2026
This page lists the sub-processors WorkWing engages to process Customer Personal Data on a Customer's behalf under Article 28 of the UK GDPR, as that term is defined in the Data Processing Agreement. It is Annex 3 to that agreement.
It deliberately does not list vendors that WorkWing engages as a controller for its own account administration, billing and platform operations (our payment provider, for example); those are named in the privacy policy, which is where the law requires a controller to identify its recipients. It also does not list vendors that receive no personal data at all, such as our key management service, which only ever sees wrapped encryption keys.
| Vendor | Purpose | Personal data processed | Processing location | Added |
|---|---|---|---|---|
| Neon, Inc. | Managed PostgreSQL database for the platform | All structured Customer Personal Data held in the Service | European Union (Frankfurt) | Initial list |
| Cloudflare, Inc. | Edge network, DNS, object storage for attachments and export files, and hosting for the customer portal | Files uploaded to jobs (photos, documents), data-subject export files, portal page requests, all traffic in transit | Cloudflare's global network, which includes locations outside the UK and EEA | Initial list |
| Hetzner Online GmbH | Cloud servers on which the Service runs | All Customer Personal Data in transit and in runtime storage on those servers | European Union (Germany, Finland) | Initial list |
| Functional Software, Inc. (Sentry) | Error and performance monitoring, and in-app problem reports | Diagnostic events and in-app support reports, which identify the signed-in user and may contain Customer Personal Data, either incidentally in an error or because a user typed it into a support report | European Union (Germany) | Initial list |
| Resend, Inc. | Transactional email (invitations, job notifications to your customers) | Recipient names and email addresses, job details | European Union (Ireland) | Initial list |
| Twilio Inc. | SMS delivery for en-route notifications to your customers | Recipient phone number, message content (brand name, technician display name, estimated arrival) | European Union (Ireland) | Initial list |
| Google LLC | Map display, address geocoding, and travel time estimation | Service addresses, job coordinates, field worker coordinates used as journey origins | United States and other locations | Initial list |
| Expo (650 Industries, Inc.) | Mobile push notification delivery | Device push tokens and notification content, which can include customer names, job references and schedule details | United States | Initial list |
Transfers outside the UK and EEA
Where a sub-processor processes Customer Personal Data outside the UK or the EEA, WorkWing relies on the safeguard provided in that sub-processor's own data processing terms: the ICO's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, as clause 7 of the Data Processing Agreement requires. We carry out and document a transfer risk assessment where one is required.
The processing locations above describe the regions our accounts are configured for. A region-scoped endpoint is not by itself proof that no transfer occurs, since the contracting entity, support-access arrangements and a vendor's own downstream sub-processors all bear on the question. The safeguard above therefore applies generally rather than being asserted vendor by vendor. We will tell you the transfer mechanism that applies to a specific sub-processor on request - email support@workwing.io.
Changes to this list
WorkWing gives at least 30 days' notice before adding or replacing a sub-processor, by email to your admin contact or by in-product notice. You may object on reasonable data protection grounds within that period; the process, including your right to terminate the affected subscription with a pro-rata refund if an objection cannot be resolved, is set out in clause 6 of the Data Processing Agreement.
Superseded versions of this list are available on request.
WorkWing is a trading name of Littlebourne Labs Ltd, a company registered in England and Wales (company no. 17119449). Registered office: 128 City Road, London, EC1V 2NX. ICO data protection registration ZC111876.
Questions about this document? Email support@workwing.io.