Sub-processors

A sub-processor is a third party that processes personal data on our behalf while we provide CubeHR to you. Each one below works under a written contract that imposes data protection obligations equivalent to those in our data processing terms, and we remain responsible to you for their work.

Crushed Ice

• Entity: Group company, part of Crushed Ice Group
• What it does: Operates the UK data centres CubeHR runs in: application servers, databases and backups, and the infrastructure support behind them.
• Data processed: All customer data held in CubeHR, including employee records.
• Location: United Kingdom
• Transfer safeguard: None needed. Data stays in the UK.

Amazon Web Services

• Entity: Amazon Web Services EMEA SARL
• What it does: Stores uploaded documents, photos and receipts (Amazon S3), delivers them to signed-in users over short-lived links (Amazon CloudFront), and sends system email such as invitations, notifications and password resets (Amazon SES).
• Data processed: Uploaded files, such as contracts, right to work documents and fit notes; recipient email addresses and message content.
• Location: United Kingdom (London region)
• Transfer safeguard: Stored and processed in the London region. A file opened from outside the UK may be served through a nearby CloudFront location, under the UK Addendum to the standard contractual clauses in the AWS data processing addendum.

If you connect your own systems to CubeHR through the API, such as a payroll package or a reporting tool, data passes between them at your direction. Those providers are your suppliers rather than our sub-processors, and the data they hold is covered by your agreement with them.

This website is separate from CubeHR. It uses Google Analytics, only if you allow it, and our email provider to deliver enquiries to us. Stripe takes subscription payments and holds our billing records, not your staff records. For all three we are the controller rather than a processor, so they are covered by our privacy policy and cookie policy rather than this list.

Before we add or replace a sub-processor, we email the account contact at every customer at least 30 days in advance, and update this page and its change log. The notice says who the provider is, what it will do, and where.

If you object on reasonable data protection grounds, tell us within that period at hello@cube-hr.co.uk. We will work with you to find a solution and, if we cannot, you may end the affected part of the service without penalty. Anyone who is not a customer but would like to hear about changes can ask to be added to the notification list.