Sub-processors

A sub-processor is an outside organisation we engage to handle personal data on our behalf so that we can run this website, our back office and our correspondence. Each one below works under a written contract that requires it to keep the data secure, to act only on our instructions, and to apply appropriate safeguards to any processing outside the UK.

This list covers our own website and correspondence. The sub-processors used to deliver a specific Skyie product are set out in the agreement and data processing addendum for that product. Read this page alongside our Privacy Notice, which gives the lawful bases, retention and your rights.

Service: the cloud servers on which our website, our back office, our database and our own mail relay run, including backups.

Entity: Contabo GmbH, Welfenstrasse 22, 81541 Munich, Germany, registered at Munich Local Court under HRB 180722. Its data protection officer is Dr Karsten Kinast of KINAST Rechtsanwaltsgesellschaft mbH, Cologne.

Its sub-processor: Contabo UK Ltd, 7 Bell Yard, London WC2A 2JR, which operates the data centre.

Processing location: Portsmouth, United Kingdom.

Personal data processed: everything our application holds — letters and the documents behind them, client and candidate records, the share and delivery records, the audit log, and server logs. Note that enquiry emails are held in the mailboxes listed below rather than here.

Contract: a data processing agreement under Article 28 GDPR, concluded on 16 August 2026, covering our Cloud VPS 40 NVMe (subscription 2860692) and Cloud VPS 20 NVMe (subscription 2934582). It requires Contabo to process only on our documented instructions and never for its own purposes; to delete all our data completely and irrevocably, including archive and backup copies, on termination or on request; to notify data breaches without undue delay; to assist with data subject rights and impact assessments; and it makes Contabo liable for its sub-processors' faults. Contabo keeps proof-of-processing documentation for ten years after termination.

Transfers: the servers are in the UK. Contabo GmbH is established in Germany and its staff access the platform to administer it, which is a transfer to the EEA. The UK's adequacy regulations cover the EEA, so no International Data Transfer Agreement is required for it.

Service: content delivery network, DNS, TLS, web application firewall, DDoS protection, and the Cloudflare Turnstile check on our contact form.

Personal data processed: more than IP addresses and security signals, and we want this entry to say so. Both skyieglobal.com and skyieglobal.co.uk are served through Cloudflare's proxy, so Cloudflare terminates the visitor's encrypted connection and handles the content of requests and responses. That includes every page, every contact-form submission (name, email address, organisation and the message itself), and every document and letter served through our expiring links at skyieglobal.co.uk/d/... — so an offer letter stating a name, a postal address, a role, a salary, a notice period and any DBS condition passes through Cloudflare's network in readable form, as does a VAT invoice.

Our application also reaches our own mail relay over a hostname that Cloudflare serves, so the body of every message we send passes through Cloudflare's network as well, including the bank account name, sort code and account number carried in an invoice email.

Processing location: Cloudflare, Inc. is a United States company operating a global network, so this content may be processed at edge locations outside the UK. Its data processing terms incorporate the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Why we keep it: for the availability and security protection it gives the site. It is a deliberate choice, disclosed rather than minimised.

Service: Exchange Online mailbox hosting for [email protected], the address published throughout our site and this notice.

Entity: Microsoft Ireland Operations Limited.

Personal data processed: every contact-form enquiry that reaches us, every application, CV or covering letter emailed to us, every reply we send from that address, and every request made to exercise a right under our Privacy Notice. Our SPF record authorises both Microsoft and our own relay to send as this domain.

Processing location: in the United Kingdom or elsewhere in the European Economic Area. Our tenant region is the United Kingdom.

Transfers and safeguards: the Microsoft Products and Services Data Protection Addendum, which incorporates the EU Standard Contractual Clauses and the UK Addendum to them. Microsoft Ireland Operations Limited is established in Ireland, which the UK's adequacy regulations cover; Microsoft's wider group includes companies outside the UK and EEA whose staff can be involved in support and administration, and the Addendum is the safeguard for that.

Retention: we clear this mailbox periodically. We have no automatic deletion rule for it today.

Service: Vertex AI, which produces the first draft of a letter when a member of our staff asks for one; and the model behind the optional Skyie Guide assistant on our website.

Personal data processed: for letter drafting, the short brief written by our staff, which normally names the recipient and states the salary, rate or fee, together with any values already decided. For the assistant, whatever a visitor chooses to type.

Processing location: letter drafting runs in Google's europe-west2 region, which is in London. Our software refuses to draft at all unless that region is the one configured, so this is enforced in code rather than set by convention. The public assistant uses the same governed service where it is configured, and otherwise falls back to Google's Gemini API, which is a different service on different terms.

Transfers: serving in London does not by itself remove the transfer question, because the Google entity we contract with is not established in the UK and support and administration can involve access from elsewhere. The safeguards are those in Google's Cloud Data Processing Addendum, which incorporates the UK Addendum to the EU Standard Contractual Clauses where a transfer needs one. We are confirming which Google entity and which terms apply to our account, and whether Google's abuse-monitoring logging of prompts applies and for how long. We will update this entry when we know.

Retention: we do not keep assistant conversations or drafting requests. What Google retains for its own service operation is governed by its terms.

Service: Google Workspace mailbox hosting for our skyieglobal.com domain. Mail addressed to that domain is delivered to Google, with our own mail server only as a fallback.

Personal data processed: correspondence sent to addresses at that domain, and its content.

Entity: not yet independently confirmed. For a UK or EEA customer this is normally a Google entity established in Ireland, but we are not asserting it here until we have verified it on our own account, and we will name it as soon as we have.

Processing location: in the United Kingdom or elsewhere in the European Economic Area. The data-region setting on the account has not yet been independently confirmed.

Transfers and safeguards: Google's Workspace data processing terms, which incorporate the UK Addendum to the EU Standard Contractual Clauses where a transfer needs one. This is a different contract from the Cloud Data Processing Addendum that covers the AI services above.

Retention: we clear these mailboxes periodically. We have no automatic deletion rule for them today.

Service: the photography and video used in the site's design.

Entity: not yet confirmed, so we name none here.

Personal data processed: most photographs are fetched by our server and re-served from our own domain, so Pexels receives nothing about you for those. Where a page shows a background video, your browser requests both the video file and its still poster image directly from Pexels' servers, so Pexels receives your IP address and basic request information at that moment, in the same way as any site you visit. No contact details, enquiry content, letters or documents are ever sent to Pexels. For those direct requests Pexels is not acting on our instructions with your data; it is a content provider your browser contacts.

Processing location: Pexels' servers, which may be outside the UK.

Outbound email — the acknowledgement of a contact-form message, our internal copy of it, and every document and letter notification — is sent by mail infrastructure we operate ourselves. It runs on our own Cloud VPS 20 (Contabo subscription 2934582), in Contabo's Portsmouth data centre, under our control. It hands messages directly to the recipient's mail provider. There is no upstream relay, smarthost or deliverability service operated by anyone else, so no third-party email sending provider is listed here.

Two qualifications, stated because they are true.

First, our application reaches that relay over the hostname relay.maielr.com, which is served through Cloudflare. Cloudflare therefore terminates the connection and handles the full message, including the bank sort code and account number in an invoice email. That is set out in the Cloudflare entry above.

Second, this relay is the sending side only. Inbound mail to our domains is held by Microsoft and by Google, as set out in their entries above. Any earlier statement of ours that our email involved no third party was wrong, and this list replaces it.

We may add, replace or remove sub-processors as our providers change. When we make a material change we will update the date at the top of this page.

For our paid products, where we act as a processor for a customer's data, notice of new sub-processors and any right to object are governed by the relevant agreement and data processing addendum rather than by this page.

Questions to [email protected].