Subprocessors Version 1.0 The third-party service providers that process personal data for Propvora, what each one does, where it processes data and how transfers are protected. 1. Introduction Blackwellen Limited ("Blackwellen", "we", "us"), company number 16482166, provides Propvora. To do so we use a small number of carefully chosen service providers. This register lists every provider that processes personal data on our behalf in connection with Propvora. A subprocessor is a third party that we engage to process Customer Personal Data (personal data that our customers store in their Workspaces, and for which the customer is the controller and we are the processor), as defined in our Data Processing Agreement (/legal/dpa) (the DPA). For completeness, this register also lists providers that act as our processors only for data we control ourselves, such as account, billing and website data (see our Privacy Policy (/legal/privacy)). The Role line for each provider tells you which applies. This register is part of the general written authorisation given by customers under section 8 of the DPA. Capitalised terms not defined here have the meanings given in the DPA. 2. Scope This register covers the Propvora product only: the website at https://propvora.com, the Propvora application, its Workspaces and Portals, the Propvora Agent and the partner programme. It does not cover Blackwellen's corporate website at https://blackwellen.com, or the tools we use to run our own business (see section 5). It also does not cover integrations or third-party services that a customer chooses to connect to its Workspace, or services that a customer's own users visit. Where a customer enables an integration, the customer is responsible for its relationship with that provider. 3. How we choose and manage providers Before engaging a provider that will process personal data, we: - assess its security and data protection practices, including its published security documentation and any independent audit reports it makes available; - put in place a written data processing agreement that meets Article 28 of the UK GDPR, including obligations at least as protective as our DPA; - choose UK or EEA processing locations wherever the provider offers them, in line with our default of UK or EEA data residency for product data; - where data may be transferred outside the UK, identify a lawful transfer mechanism and carry out a transfer risk assessment; and - limit the data the provider receives to what it needs for its function, and configure the service to minimise personal data (for example by disabling optional data collection). We review this register at least once a year and whenever we change a provider. ### Transfer safeguards explained - UK adequacy: the UK Government has recognised the country (for example EEA countries and Switzerland) as providing adequate protection, so no further safeguard is needed. - UK–US Data Bridge: the UK Extension to the EU–US Data Privacy Framework. It applies only where the US recipient is certified to it. We check certification on the Data Privacy Framework list before relying on it, and where a provider is not certified we use the IDTA or UK Addendum instead. - IDTA / UK Addendum: the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, issued by the ICO, usually incorporated into the provider's data processing agreement. In the entries below, where we have not yet confirmed the hosting region configured for Propvora, we say "[Region to be confirmed by Blackwellen]". 4. How we notify changes We will give customers at least 14 days' notice before a new subprocessor begins processing Customer Personal Data, or before we replace one. We will: 1. update this register with the new provider's name, purpose, data categories, location and transfer safeguard, and record the change in section 7 (Change history); and 2. notify each customer's account owner by email or by a notice in the application. A customer may object on reasonable data protection grounds by emailing us within the notice period. The process for handling an objection, including the option to terminate the affected part of the Service with a refund of prepaid fees for the remaining period, is set out in section 8.3 of the DPA (/legal/dpa). If we must change a provider urgently to protect the security or continuity of the Service, we may give shorter notice, explaining why. We do not need to give advance notice of a provider that only processes data we control (rather than Customer Personal Data), but we will still update this register. Anyone can ask to be told about changes by emailing info@blackwellen.com (mailto:info@blackwellen.com). 5. The register ### Supabase - Legal entity: Supabase, Inc. (United States). - Role: subprocessor of Customer Personal Data, and our processor for account data. - Purpose: our core database, user authentication (sign-in, sessions, password resets) and file storage. All Workspace records are stored in the Supabase database, which enforces our row-level security policies so that each Workspace's data stays separate. - Data categories: all categories of Customer Personal Data stored in the Service (see Annex 1 of the DPA); account data including names, email addresses, hashed passwords and sign-in events; files uploaded to Supabase storage. - Processing location: hosting region selected by us for the Propvora project, intended to be the UK or EEA, [Region to be confirmed by Blackwellen]. Supabase support and operations personnel may access data from other countries, including the United States, where needed to support the service. - Transfer safeguard: for any access from or transfer to the United States, the UK Addendum to the EU Standard Contractual Clauses in Supabase's data processing agreement, or the UK–US Data Bridge if Supabase is certified at the time of transfer. ### Vercel - Legal entity: Vercel Inc. (United States). - Role: subprocessor of Customer Personal Data (in transit and during server-side rendering), and our processor for website data. - Purpose: hosting the Propvora web application and website, running server-side code, and delivering content through its edge network. - Data categories: any data displayed in or submitted through the application as it passes through Vercel's servers; request logs including IP addresses, user agents, URLs and timestamps. - Processing location: serverless functions run in a region we select, intended to be the UK or EEA, [Region to be confirmed by Blackwellen]. Edge network traffic is served from the location nearest the user, and Vercel is headquartered in the United States. - Transfer safeguard: the UK–US Data Bridge where Vercel is certified at the time of transfer; otherwise the UK Addendum to the EU Standard Contractual Clauses in Vercel's data processing agreement. ### Cloudflare - Legal entity: Cloudflare, Inc. (United States). - Role: subprocessor of Customer Personal Data, and our processor for website data. - Purpose: R2 object storage for documents, photographs and other files uploaded to Workspaces; DNS; content delivery network (CDN); web application firewall (WAF); and protection against distributed denial-of-service (DDoS) attacks and bots. - Data categories: files uploaded to Workspaces (which may contain any category of Customer Personal Data); traffic data including IP addresses, request headers and security signals. - Processing location: R2 storage location, intended to be the EU jurisdiction where available, [Region to be confirmed by Blackwellen]. Network traffic is processed at Cloudflare's global edge locations nearest the user. - Transfer safeguard: the UK–US Data Bridge where Cloudflare is certified at the time of transfer; otherwise the UK Addendum to the EU Standard Contractual Clauses in Cloudflare's data processing addendum. Files at rest are encrypted. ### Stripe - Legal entities: Stripe Payments Europe, Limited (Ireland) and Stripe, Inc. (United States), and their affiliates as set out in Stripe's terms. The contracting Stripe entity depends on Stripe's terms for UK businesses at the time. - Role: our processor for subscription billing data. Stripe is not given access to Customer Personal Data in Workspaces. For some purposes, including fraud prevention, identity verification and meeting its financial regulatory obligations, Stripe acts as an independent controller under its own privacy notice. - Purpose: processing subscription payments, free-trial-to-paid conversion, invoices, receipts and refunds; hosted checkout and billing pages; and, through Stripe Connect, onboarding partners and paying partner commission. - Data categories: billing contact names, email addresses and billing addresses; payment card or bank details (collected directly by Stripe and never stored by us); transaction and subscription history; for partners, identity verification information, bank details, tax information and payout records. - Processing location: Ireland and the United States, and other locations where Stripe or its affiliates operate. - Transfer safeguard: Ireland is covered by UK adequacy regulations. For the United States, the UK–US Data Bridge where Stripe is certified at the time of transfer, otherwise the UK Addendum to the EU Standard Contractual Clauses in Stripe's data processing agreement. - Identity and business verification (suppliers): when a supplier completes payout setup, Stripe verifies the individual and business details (in any country, including sole traders) and tells us the outcome. We receive the verification result and the Stripe account reference, not the identity documents. ### Resend - Legal entity: Resend (the contracting entity named in Resend's terms and data processing agreement), United States. - Role: subprocessor of Customer Personal Data where the content of an email contains it, and our processor for account emails. - Purpose: sending transactional emails, such as sign-in and password-reset emails, Workspace and Portal invitations, notifications, reminders and messages that customers send to their contacts through the Service. - Data categories: recipient names and email addresses; email subject and content (which may include Customer Personal Data such as a repair update or rent reminder); delivery, bounce and complaint events. - Processing location: [Region to be confirmed by Blackwellen]. Resend is a United States company. - Transfer safeguard: the UK–US Data Bridge where Resend is certified at the time of transfer; otherwise the UK Addendum to the EU Standard Contractual Clauses in Resend's data processing agreement. ### Sentry - Legal entity: Functional Software, Inc. (Sentry), United States. - Role: our processor for technical data, and a subprocessor to the limited extent that error reports may incidentally contain Customer Personal Data. - Purpose: application error monitoring and performance diagnostics, so that we can find and fix faults quickly. - Data categories: technical data about errors, such as stack traces, the page or function involved, browser and device type, IP address (which we configure Sentry to minimise or not store where possible), the internal user or Workspace identifier, and, incidentally, fragments of data being processed when an error occurs. We configure Sentry to scrub passwords, tokens and other secrets and to avoid collecting form contents. - Processing location: Sentry offers US and EU data storage; [Region to be confirmed by Blackwellen]. - Transfer safeguard: where data is stored in the EU, UK adequacy regulations; for the United States, the UK–US Data Bridge where Sentry is certified at the time of transfer, otherwise the UK Addendum to the EU Standard Contractual Clauses in Sentry's data processing addendum. ### OpenAI - Legal entities: OpenAI Ireland Ltd (Ireland), which contracts with API customers in the UK, EEA and Switzerland, and OpenAI, L.L.C. (United States), according to OpenAI's terms at the time. - Role: subprocessor of Customer Personal Data submitted to AI features. - Purpose: powering the Propvora Agent (Beta): drafting messages, summarising records and documents, and suggesting next steps when a user asks. See our AI Disclaimer (/legal/ai-disclaimer). - Data categories: the user's instruction and the Workspace content needed to answer it, which may include any category of Customer Personal Data that the user selects or that is in the relevant record; the generated output. - Processing location: the United States and other locations where OpenAI operates, unless a data residency option is configured; [Region to be confirmed by Blackwellen]. - Data use: under OpenAI's API business terms, API inputs and outputs are not used to train OpenAI's models by default. OpenAI may keep them for up to 30 days to monitor for abuse, unless a shorter retention arrangement applies or a longer period is legally required. - Transfer safeguard: for transfers to the United States, the UK–US Data Bridge where the OpenAI entity receiving the data is certified at the time of transfer; otherwise the UK Addendum to the EU Standard Contractual Clauses in OpenAI's data processing addendum. ### Microsoft Azure OpenAI Service - Legal entity: Microsoft Ireland Operations Limited (Ireland), with Microsoft Corporation (United States) as a sub-processor under Microsoft's terms. - Role: subprocessor of Customer Personal Data submitted to AI features. - Purpose: an alternative AI model provider for the Propvora Agent, used to give resilience and to allow processing in a selected Azure region. - Data categories: the same as for OpenAI above: user instructions, the relevant Workspace content, and generated output. - Processing location: the Azure region in which our resource is deployed, intended to be the UK or EEA, [Region to be confirmed by Blackwellen]. - Data use: under Microsoft's product terms for Azure OpenAI Service, prompts and outputs are not used to train foundation models. Microsoft may keep them for a limited period (up to 30 days) for abuse monitoring, unless a modified monitoring arrangement is approved. - Transfer safeguard: UK adequacy regulations for processing in the EEA; for any onward transfer to the United States, the UK–US Data Bridge where Microsoft is certified, and the Standard Contractual Clauses with the UK Addendum in Microsoft's Data Protection Addendum. ### NVIDIA - Legal entity: NVIDIA Corporation (United States). - Role: subprocessor of Customer Personal Data submitted to AI features that use it. - Purpose: an AI inference API used to run certain AI models for Agent features. - Data categories: user instructions, the relevant Workspace content needed to answer them, and generated output. - Processing location: [Region to be confirmed by Blackwellen]. NVIDIA is a United States company. - Data use: we use NVIDIA's inference service on terms under which our inputs are not used to train NVIDIA's models, where those terms offer that choice; we limit the data sent to what each request needs. - Transfer safeguard: the UK–US Data Bridge where NVIDIA is certified at the time of transfer; otherwise the IDTA or the UK Addendum to the EU Standard Contractual Clauses. ### MapTiler - Legal entity: MapTiler AG (Switzerland). - Role: subprocessor of Customer Personal Data to the extent that property addresses are linked to individuals. - Purpose: displaying maps and converting property addresses and postcodes into map coordinates (geocoding), and back again. - Data categories: addresses and postcodes searched or geocoded, map coordinates, and technical data in requests for map tiles, such as IP address and browser type. We do not send names or other identifiers with geocoding requests. - Processing location: Switzerland and MapTiler's content delivery network; [Region to be confirmed by Blackwellen]. - Transfer safeguard: Switzerland is covered by UK adequacy regulations. Any onward transfer is covered by MapTiler's data processing terms. 6. Sources and providers that are not subprocessors ### Other categories that are not subprocessors - Providers we use to run our own business, such as banking, accounting software, professional advisers (lawyers and accountants), insurers and our own email and office tools. They may process data we control, such as correspondence or invoices, under their own terms, but they do not process Customer Personal Data held in Workspaces. If we ever need one of them to process Customer Personal Data (for example a legal adviser in a dispute), we will do so only as permitted by the DPA. - Integrations and services a customer chooses to connect, or third-party sites that a customer links to. The customer has its own relationship with these providers. - Payment card networks and banks that process a payment once Stripe submits it. They act as independent controllers under financial services law. - Public authorities, courts and regulators to which we may have to disclose information by law. They act as independent controllers. - Internet service providers and telecommunications networks that carry data between users and our providers. They transmit communications but are not engaged by us to process personal data. - Partners and affiliates in our partner programme. They are independent businesses and do not have access to Customer Personal Data. 7. Change history - 3 October 2026 (version 1.0): register first published, listing Supabase, Vercel, Cloudflare, Stripe, Resend, Sentry, OpenAI, Microsoft Azure OpenAI Service, NVIDIA and MapTiler as providers, and Companies House as a public data source. - 4 October 2026: removed the Companies House public-data reference (we do not use it); described Stripe's role in supplier identity and business verification. Future additions, removals and changes of processing location will be recorded here with the date and a short description, together with the date on which customers were notified. 8. Contact Questions about this register, requests for copies of transfer safeguards (with commercial terms removed), or objections to a new subprocessor should be sent to our data protection lead at info@blackwellen.com (mailto:info@blackwellen.com) or by post to Blackwellen Limited, 61 Bridge Street, Kington, Herefordshire, HR5 3DJ, United Kingdom. See also our Privacy Policy (/legal/privacy), Data Processing Agreement (/legal/dpa), Cookie Policy (/legal/cookies) and Security overview (/legal/security).