Sub-Processors - Workshop IT Ltd

Data Protection · Schedule 3 Reference

Sub-Processors

Workshop IT Ltd · Third parties engaged to process personal data on WIT's behalf in the delivery of managed IT services

Last updated: July 2026 Notice period: 30 days for material additions or changes Classification: Public DPA reference: Schedule 3 to the WIT Master Services Agreement Questions: legal@workshopit.co.uk

This page lists the third parties that Workshop IT Ltd ("WIT") engages to process personal data on its behalf in the delivery of managed IT services. These parties act as sub-processors under Article 28 of the UK General Data Protection Regulation and the Data Protection Act 2018, and are subject to WIT's Data Processing Agreement (Schedule 3 to the WIT Master Services Agreement).

WIT will notify clients in writing at least 30 days before making any material addition or change to this list. Clients who object on reasonable grounds should contact legal@workshopit.co.uk within 14 days of notification.

Note for MSP clients: Some sub-processors listed below operate within your own IT environment under WIT's management (for example, endpoint security and remote monitoring tools). These tools are deployed and operated by WIT on your behalf; the underlying data remains yours. Where a tool operates solely within your own tenancy or infrastructure, WIT's sub-processor relationship covers its management of that tool, not the tool itself.

IT Service Management

Sub-Processor	Purpose	Jurisdiction	Reference
Halo Service Solutions LtdHaloPSA	Helpdesk and PSA platform. Stores ticket content, client contact data, asset records, and remote session logs generated in the course of service delivery.	United Kingdom	halopsa.com
N-able TechnologiesN-able RMM	Remote monitoring and management of client endpoints. Facilitates remote access, patch management, and performance monitoring on client devices.	United States	n-able.com/legal
ITPS (IT Professional Services Ltd)OOH and SOC subcontractor	Out-of-hours and 24x7 SOC support subcontractor. ITPS engineers access client systems under WIT's direction and subject to WIT's data protection obligations.	United Kingdom	DPA on request

Infrastructure and Cloud

Sub-Processor	Purpose	Jurisdiction	Reference
Microsoft CorporationMicrosoft 365, Azure	Cloud productivity, email, document storage, and identity management. WIT's own M365 tenancy processes client-related operational data including helpdesk correspondence and project documentation.	US; EU and UK data residency available	Microsoft Trust Centre
Acronis International GmbHAcronis Cyber Protect	Cloud backup and recovery services for client environments managed by WIT.	Switzerland / EU	acronis.com/gdpr
Inevitech Ltdinevidesk vDesk and IaaS	Virtual desktop infrastructure (VDI) and hosted compute services for clients on the inevidesk platform.	United Kingdom	inevidesk.com/terms

Security and Device Management

Sub-Processor	Purpose	Jurisdiction	Reference
ESET, spol. s r.o.ESET Endpoint Security	Endpoint security and antivirus management on client devices. Processes threat detection telemetry and device activity data.	Slovakia / EU	eset.com/uk/legal
Jamf / Datajar LtdJamf Pro MDM	Mobile device management for Apple (Mac, iPhone, iPad) endpoints within client environments. Processes device enrolment data and user account associations.	US (Jamf); UK (Datajar)	jamf.com/trust-center

Communications

Sub-Processor	Purpose	Jurisdiction	Reference
Wildix S.p.A.Wildix Cloud PBX	Cloud telephony and unified communications platform. Processes call records, voicemail, and user identity data for WIT and its clients using the Wildix platform.	EU (Italy / Czech Republic)	wildix.com/privacy-policy
Exponential-e Ltd (Expo-E)SIP Trunking and Connectivity	Primary SIP trunk and connectivity provider for WIT telephony services. Processes call metadata and network traffic data.	United Kingdom	exponential-e.com/legal
Wavenet LtdWholesale Telecoms	Wholesale channel telecoms partner. Processes call data records associated with services delivered over the Wavenet network.	United Kingdom	wavenet.co.uk/legal
ICUK LtdHosted Telephony and SIP	Telecoms carrier providing hosted telephony and SIP trunk services for clients managed by WIT. Processes call detail records and associated metadata.	United Kingdom	icuk.net
G.NetworkNetwork and Connectivity	Network connectivity provider for client sites served by WIT. Processes network traffic metadata associated with services delivered over the G.Network infrastructure.	United Kingdom	g.network/legal

Finance and Administration

Sub-Processor	Purpose	Jurisdiction	Reference
Xero LtdXero Accounting	Accounting and invoicing platform. May process client contact and billing data in the context of WIT's financial operations.	New Zealand / UK	xero.com/privacy

Artificial Intelligence Platforms

Sub-Processor	Purpose	Jurisdiction	Reference
Anthropic, PBCClaude (Chat, Code, Cowork)	Large language model platform used for document production, automation, helpdesk support, meeting summaries, and internal workflow tooling.	United States (EU availability)	anthropic.com/legal
OpenAI OpCo, LLCChatGPT	Large language model platform used for scoping, ideation, and specification work. Training opt-out submitted for the company account.	United States	openai.com/policies
Microsoft CorporationMicrosoft Copilot (M365-integrated)	AI assistant integrated into the WIT M365 tenancy. Processing is tenant-resident under the existing Microsoft and WIT data-processing arrangements.	US; EU and UK data residency available	Microsoft Copilot docs
Halo Service Solutions LtdHaloPSA AI features	Optional AI features within the HaloPSA tenancy. Operates under HaloPSA's own sub-processor arrangements; no additional AI sub-processor is introduced by enabling these features.	United Kingdom	halopsa.com

Client Rights and Opt-Out

Clients may object to the addition of a new sub-processor by contacting legal@workshopit.co.uk within 14 days of receiving written notice of the change. WIT will work in good faith to resolve any reasonable objection.

Clients may separately opt out of Client-Specific External AI use (the use of AI platforms outside the Microsoft 365 tenancy on work involving their identity, systems, staff or data) at any time:

Send written notice to security@workshopit.co.uk. AI opt-out takes effect within 10 working days of receipt and does not affect other sub-processors or disable tenant-resident AI features operating within your own M365 tenancy.

Questions and Full Annex

This page reflects WIT's current active sub-processors. A complete Schedule 3 Annex, including details of transfer mechanisms for non-UK sub-processors, is available on request from legal@workshopit.co.uk.