Sub-processors
The third-party services that process personal data on FlexiEle’s behalf.
What is a sub-processor?
A sub-processor is a third-party service that FlexiEle engages to process personal data on our customers’ behalf. UK GDPR / EU GDPR (Article 28) requires that we publish the list of sub-processors and notify customers before adding new ones.
All sub-processors below are bound by data-processing agreements that include security, confidentiality and breach-notification obligations consistent with UK / EU GDPR.
Notification: we will notify customers at least 30 days before adding a new sub-processor. Customers may object to a proposed sub-processor by contacting dpo@flexiele.com within that notice period.
Amazon Web Services, Inc. (AWS)
- Purpose
- Cloud infrastructure: HRMS application servers, customer databases (Aurora / RDS), object storage (S3) for file uploads.
- Data categories
- HRMS production data; uploaded files; application logs.
- Processing region(s)
- eu-west-2 (London) for European customers; ap-south-1 (Mumbai) for Indian customers; other AWS regions matched to customer location.
- Legal entity
- Amazon Web Services EMEA SARL (Luxembourg) and AWS India Pvt Ltd, depending on customer region.
Neon Inc.
- Purpose
- Managed PostgreSQL hosting for the marketing-website database (contact-form leads, demo bookings, blog content).
- Data categories
- Marketing-prospect contact details; blog content. No HRMS customer data.
- Processing region(s)
- AWS eu-west-2 (London).
- Legal entity
- Neon Inc., USA. Underlying infrastructure is AWS in the listed region.
Vercel Inc.
- Purpose
- Hosting and content delivery for the marketing website and admin panel; serverless function execution.
- Data categories
- HTTP request metadata; admin-session cookies; build artefacts.
- Processing region(s)
- Global edge network. Functions invoked from the region nearest the visitor.
- Legal entity
- Vercel Inc., USA.
Microsoft Corporation
- Purpose
- Email hosting (Microsoft 365), calendar event creation for demo bookings (Microsoft Graph API).
- Data categories
- Email content; calendar metadata for demo bookings.
- Processing region(s)
- Microsoft 365 EU and India tenants where applicable.
- Legal entity
- Microsoft Ireland Operations Ltd (EEA / UK customers); Microsoft Corporation, USA.
OpenAI, L.L.C.
- Purpose
- AI-powered chatbot on the marketing website for visitor self-service queries.
- Data categories
- Visitor chat messages submitted to the chatbot. Not used to train OpenAI models (API zero-retention terms).
- Processing region(s)
- USA.
- Legal entity
- OpenAI, L.L.C., USA.
Abstract API
- Purpose
- Email-address verification on form submissions to reduce spam and improve lead quality.
- Data categories
- Email addresses submitted via marketing forms.
- Processing region(s)
- USA.
- Legal entity
- Abstract API LLC, USA.
Questions or objections
Contact our Data Protection Officer at dpo@flexiele.com for the current Data Processing Agreement (DPA), to subscribe to sub-processor change notifications, or to raise an objection to any sub-processor on this list.
See also our privacy policy and our trust & security overview.
Last updated: 30 April 2026