Subprocessor Register and International Transfers

TrueValue Technologies Ltd, company number 17462580, of 66 Paul Street, London, England, United Kingdom, EC2A 4NA, maintains this register to identify external organisations processing Customer Personal Data in the delivery of TrueValue. Questions and subprocessor objections should be sent to privacy@truevalue.business.

This register forms Schedule 3 to our Data Processing Agreement (DPA) when completed and incorporated into the customer agreement. It distinguishes TrueValue-appointed subprocessors, providers used for our independent controller processing, and services selected directly by a customer. A provider can have different roles for different processing; the relevant activity, not the brand name alone, determines the role.

The completed register records the legal entity, service description, data categories, primary processing location, relevant overseas access, retention or deletion cycle, and applicable safeguard for each provider. Where a supplier offers different processing arrangements, the entry must describe the arrangement TrueValue actually uses.

Configured alternatives, not in use for Customer Personal Data: OpenAI, L.L.C. (United States), the fallback route if the AI gateway is unavailable, and Anthropic, PBC (United States), available to one internal drafting tool. Each is covered by its published API data policy (no training on API data; abuse-monitoring retention of up to 30 days) and its data processing addendum. If either becomes the route for customer data, that is a subprocessor change notified under section 5.

Public registers we read — Companies House, the Global Legal Entity Identifier Foundation and the other national registers named in the product — receive only the search terms and identifiers needed to look up a company. They are sources, not processors of Customer Personal Data. No error-tracking or session-recording service is active.

Payment services: Stripe was identified in our published service documents. The final entry must identify the actual Stripe contracting entity and explain its roles for the deployed payment service. Payment details, billing contacts, transaction records and fraud-prevention information are not automatically processed as a subprocessor of the customer's deal workspace. Where the provider acts as an independent controller, its own privacy information applies to that activity; where it processes for TrueValue's controller purposes, TrueValue remains responsible for that relationship.

Stripe entry: our payment services are provided by Stripe Payments UK, Ltd. (registered in England and Wales and authorised by the Financial Conduct Authority as an electronic money institution), part of the Stripe group, and card details are entered on Stripe's own checkout pages, never on ours. Stripe processes cardholder details, billing contacts, transaction records and fraud-prevention signals as an independent controller for the payment, fraud prevention and its own legal obligations, under Stripe's privacy policy at stripe.com/gb/privacy, and holds the customer and subscription records it keeps for us under the data-processing terms of the Stripe Services Agreement. Data is processed in the United Kingdom, the European Union and the United States under Stripe's own transfer arrangements, and transaction records are retained for the periods Stripe's legal obligations require.

Advertising measurement: Meta Platforms Ireland Limited and OpenAI's ChatGPT Ads measurement service receive only the advertising events described in the Cookie Policy's inventory after a visitor accepts advertising, under each provider's applicable advertising and privacy terms. No website analytics service other than our own first-party measurement, described in the same inventory, is used.

Customer-selected integrations: an email account, storage service, CRM or external AI client independently selected and connected by a customer may receive information on the customer's instructions under a separate relationship. These providers are not automatically TrueValue-appointed subprocessors. The customer must review permissions and the provider's terms. A TrueValue-selected supplier cannot avoid subprocessor obligations merely by being labelled an integration.

Professional advisers, authorities and other occasional recipients are described in the Privacy Notice where relevant. They are not all ongoing subprocessors of Customer Personal Data.

A processing location is not the same as a company's headquarters. A local database region does not exclude overseas support access, replication, logging, communications or AI processing. We identify relevant destinations rather than simply listing the country where a supplier was incorporated.

For each restricted transfer, we document the lawful mechanism and required assessment. Depending on the circumstances, this may involve an applicable adequacy arrangement, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU clauses for processing subject to EU GDPR. An applicable certification or framework is relied upon only after checking the exact entity, scope and current validity.

Listing a possible mechanism in a policy does not execute it. Required instruments and annexes must be in place before the transfer. We review material changes affecting protection and take appropriate action if a mechanism is no longer valid. Customers may request relevant safeguard information from privacy@truevalue.business, subject to necessary confidentiality redactions.

We give at least 30 calendar days' notice to the nominated customer contact before adding or replacing a subprocessor for that customer's processing, as set out in the DPA. The notice identifies the new entity, purpose and relevant locations. Keep your administrative contact details current.

A customer may object within that period on reasonable data-protection grounds. We consider the concern, provide information and seek a reasonable alternative or appropriate restriction. A timely unresolved objection is handled under the DPA, including termination of the affected service with a pro-rata refund of prepaid unused fees where no reasonable solution is available. We do not treat silence as permission for an undisclosed new processing purpose.

The publication date identifies the register version. We retain prior versions so a customer can establish the suppliers applicable to its agreement and subsequent changes. Requests for a signed DPA, supplier information or a change-notification contact should be sent to privacy@truevalue.business.