Kflows Ltduses the following third-party service providers (“Sub-processors”) to help us deliver our services to clients. This page lists the sub-processors that may process Personal Data on our clients’ behalf when we act as a Processor under a Data Processing Agreement.
If you are a client of Kflows, this page mirrors Schedule 3 of the Data Processing Agreement signed between us. ICO registration: ZC110393.
Current sub-processors
| Sub-processor | Purpose | Location | Transfer mechanism | Website |
|---|---|---|---|---|
| Pipedrive OÜ | Customer and account records: hosting and processing | Estonia (EEA) | UK adequacy decision for EEA | pipedrive.com |
| n8n GmbH | Connecting our systems so enquiries and results move between them (cloud) | Germany (EEA) | UK adequacy decision for EEA | n8n.io |
| Anthropic PBC | Language-model processing (zero-retention API; no training on input) | United States | UK-US Data Bridge / SCCs (DPF certified) | anthropic.com |
| Google LLC (Workspace) | Email, document handling, and Gemini (where engaged) | United States | UK-US Data Bridge (Google CDPA) | workspace.google.com |
| Secure Privacy ApS | Cookie consent banner on kflows.co.uk and the record of each visitor's choice | Denmark (EEA) | UK adequacy decision for EEA | secureprivacy.ai |
| Netlify Inc. | Hosting kflows.co.uk and receiving its forms | United States | UK-US Data Bridge (DPF certified) | netlify.com |
| Stripe Inc. | Payment processing (Kflows billing) | US / EU | UK-US Data Bridge (DPF certified) | stripe.com |
| Airtable Inc. | Operations database (where engaged on a client deliverable) | United States | UK-US Data Bridge / SCCs (DPA executed) | airtable.com |
| Zapier Inc. | Connecting systems (where engaged on a client deliverable) | United States | UK-US Data Bridge (DPF certified) | zapier.com |
| Perplexity AI Inc. | Research (Enterprise / API tier; where engaged) | United States | UK-US Data Bridge / SCCs | perplexity.ai |
Language-model providers. All such processing is performed via enterprise or API tiers with contractual zero-retention and no-training terms. Kflows does not use consumer products (for example free-tier chat interfaces) to process client Personal Data.
Stripe. For certain activities (PCI-DSS compliance, anti-money-laundering), Stripe acts as an independent Controller rather than a Sub-processor. We will inform clients where this distinction applies.
Kflows’ own marketing tools
The following tools are used by Kflows for our own marketing and outbound sales. They process business contact data under our own Legitimate Interests assessment and do not process client Personal Data unless explicitly engaged in a client deliverable, in which case they are added to the table above and prior notice is given.
- Apollo.io Inc.: B2B contact data
- Clay Labs Inc.: data enrichment
- Instantly.ai: cold email delivery
- MillionVerifier: email verification
- LinkedIn Corp. (Sales Navigator): prospect research
- Cognism Ltd.: B2B contact data
- HeyReach: LinkedIn outreach
- Firecrawl: web research
- SerpApi LLC: search API
Full details are in our Privacy Policy.
Notice of changes
We will provide clients with at least 30 days’ prior written notice of any intended changes to our Sub-processors, including additions or replacements. Clients may object on reasonable data-protection grounds within 14 days of notice, in accordance with the Data Processing Agreement. To be told of changes, email us and ask to be added to the notice list.
Contact
Questions or objections: info@kflows.co.uk. Post: Kflows Ltd, 18 Dublinhill Road, Dromore, County Down, BT25 1SY, United Kingdom.
Previous versions of this page are available on request.