This Sub-processors List is published by WhealBit ("WagePilot", "we", "us"). It forms part of, and is incorporated by reference into, the Data Processing Agreement at /legal/dpa (the "DPA"), as that DPA and this list are in force from time to time, agreed between WagePilot (acting as processor) and each business customer (acting as controller of its staff personal data). It should be read together with our Privacy Policy, Terms of Service, Cookie Policy and Security page. Capitalised terms used but not defined here have the meaning given in the DPA; where a term is not defined in the DPA, it has the meaning given in the UK GDPR.
1. What a sub-processor is
A "sub-processor" is a third party engaged by WagePilot to process personal data on our behalf in the course of providing the WagePilot service to you, where that processing is carried out under our instructions and on behalf of you as controller. Under Article 28 of the UK GDPR we may only engage a sub-processor with your authorisation, and we must impose on each sub-processor, by written contract, data-protection obligations equivalent to those that apply to us under the DPA.
In accordance with Article 28(4) of the UK GDPR, where a sub-processor fails to fulfil its data-protection obligations we remain liable to you for the performance of that sub-processor's obligations. That liability applies to the same extent as, and is subject to the limitations and exclusions of liability set out in, the DPA and the Terms of Service; nothing in this list creates any liability beyond, or outside the caps and exclusions of, those documents, and nothing in this list excludes or limits any liability that cannot lawfully be excluded or limited.
This list does not include third parties that act as independent controllers in their own right (rather than as our sub-processors). Where a supplier acts as an independent controller for a defined set of data, that is noted in the table below and, for that data, the supplier's own terms and privacy notice apply.
2. Your authorisation of these sub-processors
By entering into the DPA, you give your general written authorisation to our use of the sub-processors listed in the table below to process personal data for the purposes described, on the basis of this list as in force at the time you enter into the DPA and as subsequently changed under sections 5 and 6. This authorisation is subject to the conditions in Articles 28(2) and 28(4) of the UK GDPR and to the notice and objection process set out in sections 5 and 6 below and in the DPA.
We engage each sub-processor under a written contract that imposes the obligations required by Article 28(3) of the UK GDPR, including obligations of confidentiality, technical and organisational security measures appropriate to the risk under Article 32, and assistance with data-subject rights and personal-data-breach notification. Where a sub-processor carries out any processing in a country that is not covered by UK adequacy regulations, that processing is covered by an appropriate Article 46 transfer safeguard (for example the ICO International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the ICO UK Addendum), supported by a transfer risk assessment. The safeguards that apply to each sub-processor are set out in the "Safeguards" column below.
3. Current sub-processors
The following third parties are engaged by WagePilot as sub-processors. We will keep this list current and will update it before adding or replacing a sub-processor, in accordance with section 5. The suppliers' legal entities are Supabase, Inc.; Vercel, Inc.; Stripe Payments UK, Ltd. / Stripe, Inc.; Resend, Inc.; Cloudflare, Inc..
| Sub-processor | Purpose / processing | Personal data involved | Location / region | Safeguards |
|---|---|---|---|---|
| Supabase (Supabase, Inc.) | Primary application database (PostgreSQL), user authentication, and file storage (including any kiosk clock-event photos and CSV/export files). This is where the core service data is held and processed. | Account-holder name and email; business/organisation details; staff names and contact details; pay rates; rota and shift data; holiday and leave records (which may include free-text leave reasons that reveal health, that is, special-category data under Article 9); timesheets; clock-in/out location captured only at the clock event; optional kiosk clock-event photos; device and usage logs. | EU (Frankfurt, eu-central-1) | Supabase's standard Article 28(3) DPA applies via its terms; the primary region is pinned to the EU (Frankfurt) with no failover outside adequate countries This is the row holding the highest-sensitivity data; heightened technical and organisational measures (access controls, encryption in transit and at rest, UK/EU residency) apply per the DPA TOMs schedule. |
| Vercel (Vercel, Inc.) | Hosting of the WagePilot web application and execution of serverless functions (including API endpoints for onboarding, billing and email), together with associated request, application and infrastructure logs. Also provides Vercel Web Analytics, the cookieless analytics used on the WagePilot marketing site (in respect of marketing-site visitors, for whom WagePilot acts as controller rather than as a processor of customer staff data), to understand which pages are useful. | Data submitted to or returned by the application during use, including account and staff data passing through requests; technical and usage data such as IP address, device/browser information, and application and access logs. For analytics: aggregated page-view and usage data, with IP address and browser information used transiently to de-duplicate visitors and not stored as a persistent identifier. | United States | Vercel's standard Article 28(3) DPA applies via its terms; for processing, support or backup outside the UK/EEA (US likely), Vercel's EU SCCs + UK Addendum and a transfer risk assessment apply |
| Stripe (Stripe Payments UK, Ltd. and/or Stripe, Inc.) | Subscription billing and payment processing for paid plans, including handling of card details entered at checkout. WagePilot does not receive or store full payment card numbers; card data is captured and held directly by Stripe, which states that it operates to PCI-DSS Level 1. | Account-holder name and email; billing contact details; subscription, plan and transaction records and identifiers. Full payment card data is processed by Stripe and is not received by WagePilot. | Stripe Payments UK, Ltd. (UK / global) | Stripe Payments UK, Ltd. (independent controller for card data); for any restricted transfers, Stripe's SCCs + UK Addendum and a transfer risk assessment apply Stripe contracts on the basis that it acts as an independent controller (not our sub-processor) for the card and payment data it determines how to process, and Stripe's own terms and privacy notice apply to that data. We do not seek to disclaim responsibility for billing-data flows that we ourselves control. |
| Resend (Resend, Inc.) | Delivery of transactional and service emails, such as account verification, employee login/credential emails, password resets, and billing and service notifications. | Recipient name and email address; email subject and message content (which may include a login link, set-up instructions, or a temporary credential); delivery metadata such as send, bounce and delivery status. | United States | Resend's standard Article 28(3) DPA applies via its terms; for processing outside the UK/EEA (US likely), Resend's EU SCCs + UK Addendum and a transfer risk assessment apply |
| Cloudflare (Cloudflare, Inc.) | Bot and abuse protection (Cloudflare Turnstile CAPTCHA) on authentication flows, including sign-in, the staff join/redeem flow and password reset, to protect accounts and the Service against automated abuse. | End-user IP address; browser and device challenge signals; the Turnstile challenge token. No staff timesheet, pay, leave or location data is sent to this service. | Global / United States | Cloudflare's standard Article 28 DPA applies via its terms; for processing outside the UK/EEA, Cloudflare's EU SCCs + UK Addendum and a transfer risk assessment apply |
The descriptions above are provided to help you meet your own transparency and record-keeping obligations as controller. They do not vary the allocation of roles set out in the DPA. You remain the controller of your staff personal data and are responsible for your own privacy notices to your workers; WagePilot does not discharge that duty on your behalf.
Special-category and free-text data. The leave-reason field is free text. As controller, you are responsible for ensuring you have a lawful basis, including an Article 9(2) condition (for example the employment condition in Schedule 1 to the Data Protection Act 2018) and, where required, an appropriate policy document, before entering special-category data such as health information, and for instructing your workers accordingly. We process such data only on your documented instructions and apply our standard technical and organisational measures, with heightened measures for the Supabase row as noted above. We recommend using structured leave types rather than free text wherever possible, to support data minimisation under Article 5(1)(c).
No compliance guarantee. WagePilot is a record-keeping and calculation tool only. We do not provide legal, tax, payroll or employment-law advice, and we do not warrant that use of the Service ensures compliance with the National Minimum Wage or National Living Wage, the Working Time Regulations, holiday-pay rules or any other legal obligation; National Minimum Wage and similar checks are provided as guidance only. You remain solely responsible for verifying that pay, hours and leave outcomes meet applicable law. The substantive version of this carve-out is set out in the Terms of Service.
4. Retention
We retain personal data only for as long as needed to provide the Service and to meet legal and contractual obligations. In outline, and subject to the detail in the DPA and our Privacy Policy:
- Core service data held in Supabase (account, staff, rota, timesheet, leave and clock data) is retained for the life of your account and for any period you are required to keep it, then deleted or anonymised. Statutory minimums you may need to observe include National Minimum Wage records for 6 years, PAYE records for 3 years and Working Time Regulations records for 2 years; you, as controller, set the applicable retention rule.
- Kiosk clock-event photos are retained as audit images until the worker or account is erased, when they are stripped; there is no separate time-based purge job at present.
- Operational logs (for example Vercel request/infrastructure logs and Resend email delivery logs) and backups are retained for limited periods in line with each supplier's standard retention policy (for example, Vercel diagnostic logs are typically retained for around 30 days), then deleted or overwritten.
5. International transfers
We aim to keep staff and account personal data stored and processed within the UK or another country covered by UK adequacy regulations (which currently includes the EEA). Where a sub-processor carries out any restricted transfer to a country that is not covered by UK adequacy regulations, we rely on a valid Article 46 transfer mechanism (such as the ICO IDTA, or the EU Standard Contractual Clauses together with the ICO UK Addendum), supported by a documented transfer risk assessment. The specific mechanism relied on for each sub-processor is set out in the "Safeguards" column above. We keep our transfer and adequacy positions under review, including under the Data (Use and Access) Act 2025 and its amendments to the UK GDPR. Our Privacy Policy explains how this applies to the personal data we hold.
6. How we notify you of changes to sub-processors
We may add a new sub-processor, or replace an existing one, from time to time as the service evolves. Before a new or replacement sub-processor begins processing personal data on our behalf, we will:
- update this page to reflect the addition or change and update the "last updated" date in section 9; and
- provide advance notice to customers of at least 30 days by email to the account-holder and/or by an in-product or website notice, in accordance with the DPA.
To receive notice of changes, you can subscribe to updates at email info@whealbit.co.uk to be added to our sub-processor change notification list. We recommend that you also check this page periodically and keep your account-holder contact details up to date so that you receive notices. We will not rely on a notification channel that is not actually operational; if the subscribe mechanism is not yet live, the advance-notice email described above is the operative method.
We may make an urgent change to a sub-processor on shorter notice where this is reasonably required to maintain the security or continuity of the Service, or where an existing sub-processor ceases to provide the relevant service. In that case we will give notice as soon as reasonably practicable and your objection right in section 7 continues to apply.
7. Your right to object
If you have a reasonable, good-faith data-protection objection to a new or replacement sub-processor, you may object by giving us written notice within 30 days from notice, setting out the grounds for your objection.
If you object, we will work with you in good faith to address your concern. Where we are reasonably able to do so, we will seek to make the Service available to you in a manner that avoids the use of the objected-to sub-processor for your data. If we are unable to provide a reasonable alternative within a reasonable period, you may terminate the affected service in accordance with the DPA and the Terms of Service, and, where the DPA so provides, receive a pro-rata refund of fees paid in advance for the unused portion of the affected service. To the extent permitted by law and subject to our Article 28(4) liability, such termination is your sole and exclusive remedy where an unresolved good-faith objection prevents us from providing the affected service, and we are not liable for any resulting interruption that is beyond our reasonable control or caused by a sub-processor's outage or force-majeure event. Nothing in this section limits any rights you may have that cannot lawfully be excluded or limited; and, where you are a consumer, nothing in this section affects your statutory rights under the Consumer Rights Act 2015 or the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013.
8. Contact
If you have any questions about our sub-processors, this list, or the safeguards described here, please contact us at info@whealbit.co.uk, or write to St Ives, Cornwall. The marketing site is wagepilot.co.uk and the app is at app.wagepilot.co.uk.
9. Changes to this list
This Sub-processors List forms part of the DPA and may be updated from time to time as described in section 6. The version published on this page at any given time is the current list, and we maintain an archive of prior versions so that the version in force when you entered into the DPA can be identified. This list was last updated on 1 July 2026.