Legal
Sub-processors
Third-party providers that Workshop IT Ltd may engage when delivering its services.
Workshop IT Ltd · Third parties engaged to process personal data on WIT's behalf in the delivery of managed IT services
This page lists the third parties that Workshop IT Ltd ("WIT") engages to process personal data on its behalf in the delivery of managed IT services. These parties act as sub-processors under Article 28 of the UK General Data Protection Regulation and the Data Protection Act 2018, and are subject to WIT's Data Processing Agreement (Schedule 3 to the WIT Master Services Agreement).
WIT will notify clients in writing at least 30 days before making any material addition or change to this list. Clients who object on reasonable grounds should contact legal (at) workshopit (dot) co (dot) uk within 14 days of notification.
Note for MSP clients: Some sub-processors listed below operate within your own IT environment under WIT's management (for example, endpoint security and remote monitoring tools). These tools are deployed and operated by WIT on your behalf; the underlying data remains yours. Where a tool operates solely within your own tenancy or infrastructure, WIT's sub-processor relationship covers its management of that tool, not the tool itself.
IT Service Management
| Sub-Processor | Purpose | Jurisdiction | Reference |
|---|---|---|---|
| Halo Service Solutions Ltd HaloPSA | Helpdesk and PSA platform. Stores ticket content, client contact data, asset records, and remote session logs generated in the course of service delivery. | United Kingdom | halopsa.com |
| N-able Technologies N-able RMM | Remote monitoring and management of client endpoints. Facilitates remote access, patch management, and performance monitoring on client devices. | United States | n-able.com/legal |
| ITPS (IT Professional Services Ltd) OOH and SOC subcontractor | Out-of-hours and 24x7 SOC support subcontractor. ITPS engineers access client systems under WIT's direction and subject to WIT's data protection obligations. | United Kingdom | DPA on request |
Infrastructure and Cloud
| Sub-Processor | Purpose | Jurisdiction | Reference |
|---|---|---|---|
| Microsoft Corporation Microsoft 365, Azure | Cloud productivity, email, document storage, and identity management. WIT's own M365 tenancy processes client-related operational data including helpdesk correspondence and project documentation. | US; EU and UK data residency available | Microsoft Trust Centre |
| Acronis International GmbH Acronis Cyber Protect | Cloud backup and recovery services for client environments managed by WIT. | Switzerland / EU | acronis.com/gdpr |
| Inevitech Ltd inevidesk vDesk and IaaS | Virtual desktop infrastructure (VDI) and hosted compute services for clients on the inevidesk platform. | United Kingdom | inevidesk.com/terms |
Security and Device Management
| Sub-Processor | Purpose | Jurisdiction | Reference |
|---|---|---|---|
| ESET, spol. s r.o. ESET Endpoint Security | Endpoint security and antivirus management on client devices. Processes threat detection telemetry and device activity data. | Slovakia / EU | eset.com/uk/legal |
| Jamf / Datajar Ltd Jamf Pro MDM | Mobile device management for Apple (Mac, iPhone, iPad) endpoints within client environments. Processes device enrolment data and user account associations. | US (Jamf); UK (Datajar) | jamf.com/trust-center |
Communications
| Sub-Processor | Purpose | Jurisdiction | Reference |
|---|---|---|---|
| Wildix S.p.A. Wildix Cloud PBX | Cloud telephony and unified communications platform. Processes call records, voicemail, and user identity data for WIT and its clients using the Wildix platform. | EU (Italy / Czech Republic) | wildix.com/privacy-policy |
| Exponential-e Ltd (Expo-E) SIP Trunking and Connectivity | Primary SIP trunk and connectivity provider for WIT telephony services. Processes call metadata and network traffic data. | United Kingdom | exponential-e.com/legal |
| Wavenet Ltd Wholesale Telecoms | Wholesale channel telecoms partner. Processes call data records associated with services delivered over the Wavenet network. | United Kingdom | wavenet.co.uk/legal |
| ICUK Ltd Hosted Telephony and SIP | Telecoms carrier providing hosted telephony and SIP trunk services for clients managed by WIT. Processes call detail records and associated metadata. | United Kingdom | icuk.net |
| G.Network Network and Connectivity | Network connectivity provider for client sites served by WIT. Processes network traffic metadata associated with services delivered over the G.Network infrastructure. | United Kingdom | g.network/legal |
Finance and Administration
| Sub-Processor | Purpose | Jurisdiction | Reference |
|---|---|---|---|
| Xero Ltd Xero Accounting | Accounting and invoicing platform. May process client contact and billing data in the context of WIT's financial operations. | New Zealand / UK | xero.com/privacy |
Artificial Intelligence Platforms
| Sub-Processor | Purpose | Jurisdiction | Reference |
|---|---|---|---|
| Anthropic, PBC Claude (Chat, Code, Cowork) | Large language model platform used for document production, automation, helpdesk support, meeting summaries, and internal workflow tooling. | United States (EU availability) | anthropic.com/legal |
| OpenAI OpCo, LLC ChatGPT | Large language model platform used for scoping, ideation, and specification work. Training opt-out submitted for the company account. | United States | openai.com/policies |
| Microsoft Corporation Microsoft Copilot (M365-integrated) | AI assistant integrated into the WIT M365 tenancy. Processing is tenant-resident under the existing Microsoft and WIT data-processing arrangements. | US; EU and UK data residency available | Microsoft Copilot docs |
| Halo Service Solutions Ltd HaloPSA AI features | Optional AI features within the HaloPSA tenancy. Operates under HaloPSA's own sub-processor arrangements; no additional AI sub-processor is introduced by enabling these features. | United Kingdom | halopsa.com |
Client Rights and Opt-Out
Clients may object to the addition of a new sub-processor by contacting legal (at) workshopit (dot) co (dot) uk within 14 days of receiving written notice of the change. WIT will work in good faith to resolve any reasonable objection.
Clients may separately opt out of Client-Specific External AI use (the use of AI platforms outside the Microsoft 365 tenancy on work involving their identity, systems, staff or data) at any time:
Send written notice to security (at) workshopit (dot) co (dot) uk. AI opt-out takes effect within 10 working days of receipt and does not affect other sub-processors or disable tenant-resident AI features operating within your own M365 tenancy.
Questions and Full Annex
This page reflects WIT's current active sub-processors. A complete Schedule 3 Annex, including details of transfer mechanisms for non-UK sub-processors, is available on request from legal (at) workshopit (dot) co (dot) uk.