Approved Subprocessor Register
Third-Party Infrastructure, Data Location & International Transfer Transparency
Company Number: SC806877 (Registered in Scotland)
Registered Office: 17 Mill Street, Alloa, Clackmannanshire, FK10 1DT, UK
Notice Period: 30 Days Prior Written Notice for Changes
DPO Contact: info@fusionsynthtech.co.uk
To provide high-availability SaaS infrastructure, transactional communications, and real-time care worker alerts, CareAssist engages carefully vetted third-party service providers ("Subprocessors"). In accordance with Article 28(3)(d) of the UK GDPR and Section 4 of our Data Processing Agreement, this register transparently outlines every active subprocessor, their role, and the verified legal transfer mechanisms in place.
17.1 Active Subprocessor Register
| Subprocessor | Corporate HQ | Service Provided | Data Processing Location | Transfer Mechanism |
|---|---|---|---|---|
| Hetzner Online GmbH | Gunzenhausen, Germany | Primary Cloud Infrastructure, PostgreSQL Database & Virtual Compute | Falkenstein, Saxony, Germany (EU) | UK-EU Adequacy (Art 45) |
| Hetzner Online GmbH | Gunzenhausen, Germany | Off-site Encrypted Disaster Recovery & S3 Object Storage | Helsinki, Finland (EU) | UK-EU Adequacy (Art 45) |
| Postmark (ActiveCampaign) | Delaware, USA | Transactional System Emails (Password Resets, Compliance Alerts) | US East (End-to-End Encrypted) | UK IDTA / Standard Clauses |
| Twilio Inc. | California, USA | Critical SMS Rota Alerts & Two-Factor Authentication (2FA) | US East (End-to-End Encrypted) | UK IDTA / Standard Clauses |
| Vercel Inc. | California, USA | Edge Delivery Network (CDN) & Static Application Hosting | London (LHR1 Edge) / Global Edge | UK IDTA / Standard Clauses |
17.2 Change Notification & Right to Object
CareAssist provides subscribing agencies with at least 30 calendar days' advance written notice before appointing any new infrastructure or communications subprocessor. Notice will be delivered via email to designated agency primary administrators and published on this register.
Subscribing agencies (as Controllers) have the right to object to the appointment of a new subprocessor on reasonable data protection grounds by submitting written notice within 14 calendar days of receiving notice to info@fusionsynthtech.co.uk.
17.3 Subprocessor Security Safeguards
Before engaging any subprocessor, CareAssist conducts rigorous information security and legal reviews, verifying that the subprocessor maintains:
- Independently audited compliance certifications (e.g., ISO/IEC 27001, SOC 2 Type II).
- Binding Data Processing Addendums incorporating Article 28 UK GDPR commitments.
- AES-256 encryption at rest and TLS 1.3 encryption in transit.
- Strict geographic routing ensuring primary client health data remains within approved UK/EU jurisdictions.