Sub-processors
Who processes data on our behalf.
The third-party services FlexiEle engages to run the platform — kept deliberately short, each bound by a data-processing agreement.
Last updated:
What is a sub-processor?
A sub-processor is a third-party service that FlexiEle engages to process personal data on our customers’ behalf. UK GDPR / EU GDPR (Article 28) requires that we publish the list of sub-processors and notify customers before adding new ones.
All sub-processors below are bound by data-processing agreements that include security, confidentiality and breach-notification obligations consistent with UK/EU GDPR.
Notification
We will notify customers at least 30 days before adding a new sub-processor. Customers may object to a proposed sub-processor by contacting dpo@flexiele.com within that notice period.
Current sub-processors
Amazon Web Services, Inc. (AWS)
- Purpose
- Cloud infrastructure: application servers, customer databases and encrypted storage for the Care Management System and HR platform.
- Data categories
- Resident care records; staff and HR data; application logs.
- Processing region(s)
- eu-west-2 (London), United Kingdom.
- Legal entity
- Amazon Web Services EMEA SARL (Luxembourg).
Neon Inc.
- Purpose
- Managed PostgreSQL hosting for the marketing-website database (contact-form leads, demo bookings).
- Data categories
- Marketing-prospect contact details. No resident or staff platform data.
- Processing region(s)
- AWS eu-west-2 (London), United Kingdom.
- Legal entity
- Neon Inc., USA. Underlying infrastructure is AWS in the listed UK region.
Vercel Inc.
- Purpose
- Hosting and content delivery for the marketing website; serverless function execution.
- Data categories
- HTTP request metadata; build artefacts. No resident care data.
- Processing region(s)
- Global edge network; functions invoked from the region nearest the visitor.
- Legal entity
- Vercel Inc., USA.
Microsoft Corporation
- Purpose
- Email hosting (Microsoft 365) and calendar event creation for demo bookings (Microsoft Graph API).
- Data categories
- Email content; calendar metadata for demo bookings.
- Processing region(s)
- Microsoft 365 UK / EU tenant.
- Legal entity
- Microsoft Ireland Operations Ltd (EEA / UK); Microsoft Corporation, USA.
Abstract API
- Purpose
- Email-address verification on website form submissions, to reduce spam and improve lead quality.
- Data categories
- Email addresses submitted via marketing forms.
- Processing region(s)
- USA (governed by Standard Contractual Clauses / UK IDTA).
- Legal entity
- Abstract API LLC, USA.
What we keep in-house
Voice transcription is not outsourced.
Voice notes captured at the point of care are transcribed on FlexiEle’s own UK infrastructure — they are not sent to any third-party transcription or AI provider. This is a deliberate design choice for the sensitivity of care data, and it is why no transcription supplier appears on the list above.
Questions or objections
Contact our Data Protection Officer at dpo@flexiele.com for the current Data Processing Agreement (DPA), to subscribe to sub-processor change notifications, or to raise an objection to any sub-processor on this list.
See also our privacy policy and our Trust & Security overview.