Sub-processor List

Effective Date: 3 August 2026

Introduction

This Sub-processor List identifies the categories of third-party service providers ("Sub-processors") that Protection Research Ltd ("Protection Research", "we", "our" or "us") may engage to support the delivery of our Services.

This document should be read alongside our:

Privacy Policy;

Data Processing Agreement;

Security & Privacy Overview; and

Information Security Policy. Protection Research undertakes appropriate due diligence before engaging Sub-processors that process personal data on our behalf and seeks to ensure that appropriate contractual safeguards are in place in accordance with applicable data protection laws.

Current Sub-processors

Protection Research may engage Sub-processors in the following categories to support delivery of the Services. Specific provider identities may change from time to time as our operational arrangements evolve.

Category: Cloud application hosting

Purpose: Hosting of websites, applications and related workloads that support the Services Typical processing location: United Kingdom and/or other jurisdictions with appropriate transfer safeguards where required Category: Managed database, authentication and application data services Purpose: Account authentication, session management, storage of application and account data, and related operational data processing Typical processing location: United Kingdom and/or other jurisdictions with appropriate transfer safeguards where required

Category: Payment processing

Purpose: Subscription billing, payment collection and related payment operations Typical processing location: United Kingdom, European Economic Area and/or other jurisdictions with appropriate transfer safeguards where required

Category: Transactional email and customer communications

Purpose: Service notifications, account emails and related customer communications Typical processing location: United Kingdom and/or other jurisdictions with appropriate transfer safeguards where required

Category: Security monitoring and operational tooling

Purpose: Security logging, monitoring, diagnostics and operational support of the Services Typical processing location: United Kingdom and/or other jurisdictions with appropriate transfer safeguards where required Customers requiring additional information about Sub-processors for compliance or procurement purposes may contact us using the details below.

How We Select Sub-processors

Protection Research seeks to engage Sub-processors that maintain security and privacy practices appropriate to the services they provide. When selecting a Sub-processor, we may consider factors including: information security practices; privacy and data protection compliance; contractual commitments; operational resilience; reputation and reliability; geographic location of processing; availability of appropriate technical and organisational measures; and ability to support our legal and contractual obligations.

International Transfers

Where a Sub-processor processes personal data outside the United Kingdom, Protection Research seeks to ensure that appropriate safeguards are implemented in accordance with applicable data protection legislation.

Such safeguards may include:

UK International Data Transfer Agreements (IDTAs);

the UK Addendum to the EU Standard Contractual Clauses
adequacy regulations; or

other lawful transfer mechanisms recognised under applicable law.

Changes to Sub-processors

Protection Research may add, replace or remove Sub-processors from time to time as our Services evolve. This document will be updated to reflect material changes to our Sub-processor arrangements. Where required by contract or applicable law, affected customers will be notified of relevant changes.

Customer Enquiries

Customers who have questions regarding our Sub-processors or require additional information for compliance or procurement purposes may contact us using the details below.