Subprocessors

We keep the vendor list short on purpose. Each provider below has a defined job, receives only the data that job requires, and is covered by a written agreement. Analytics providers receive nothing until a visitor turns analytics on in the cookie settings.

During an engagement we work inside platforms the client already owns and licenses, such as a CRM, a billing system or a reporting tool. Those platforms are the client's vendors, not ours. We access them under the client's direction and permissions, we do not copy data out of them except where the engagement requires it, and access is removed at the end of the engagement or on request.

• A written agreement limiting processing to our documented instructions.
• Confidentiality obligations covering their personnel.
• Encryption of data in transit, and at rest where the provider stores it.
• Notification to us of a security incident affecting our data.
• Standard Contractual Clauses, or the UK Addendum where applicable, for transfers out of the EU, EEA, UK or Switzerland.
• Deletion or return of data at the end of the relationship.

Under PIPEDA we remain accountable for personal information we transfer to a provider for processing. Using a provider does not move that responsibility off us.

When we add or replace a provider that processes personal information, we update this page and change the effective date at the top. Clients under an active engagement receive notice by email before a new provider begins processing their data, and may object on reasonable data protection grounds.

For a copy of the processing terms with a specific provider, or to raise an objection, write to shannon@thecwtstudio.com. Related reading: the privacy notice and the security overview.