← Commercial Intelligence Partners

Sub-processors

Last updated 13 October 2026

Version 1.2 — effective {{EFFECTIVE_DATE}}.

{{COMPANY_LEGAL_NAME}} (company number {{COMPANY_NUMBER}}), trading as Commercial Intelligence Partners ("CIP"), uses the service providers below to run the CIP service. This page forms Annex 3 of our Data Processing Agreement (/legal/dpa).

"Your data" below means the data you, as our client, put into CIP — including details of your staff and your customers — which we process as your processor.

1. Providers that process your data

  • Vercel Inc. — what they do: hosts and runs the CIP web application; application compute runs in London (region lhr1); static content is served through Vercel's global network. Data involved: all data passing through the application while it is in use, plus application logs. Where: UK (London) compute — Vercel is a US company, and support or network operations may involve access from the US and other countries. UK transfer protection: UK Addendum / IDTA incorporated in Vercel's DPA. Their DPA: https://vercel.com/legal/dpa
  • Neon (a Databricks company) — what they do: Postgres database, backups and point-in-time recovery. Data involved: all stored data. Where: London, United Kingdom (AWS eu-west-2). UK transfer protection: for storage in the UK, no restricted transfer; for storage in the EEA, UK adequacy regulations for the EEA; for any access from outside those areas, the transfer terms in Neon's DPA. Their DPA: https://neon.com/dpa
  • Cloudflare, Inc. — what they do: Cloudflare Turnstile, a bot-protection check on the CIP sign-in page (it runs when you ask for a sign-in code) and on our public forms (book a review, calculator results, waitlist). Data involved: the visitor's IP address, browser and device signals and the challenge result; no account or business data. Where: United States, with processing on Cloudflare's global network. UK transfer protection: UK Extension to the EU-US Data Privacy Framework (Cloudflare states it is certified), with the UK Addendum as a fallback. Their DPA: https://www.cloudflare.com/cloudflare-customer-dpa/
  • Resend (Plus Five Five, Inc.) — what they do: sends emails — invoices and payment reminders you send to your customers, and account emails such as invitations, one-time sign-in codes and security notices. Data involved: recipient name and email address, email content (including invoice details), delivery status. Where: United States. UK transfer protection: UK Addendum to the EU Standard Contractual Clauses, incorporated in Resend's DPA; Resend also states it is certified under the Data Privacy Framework. Their DPA: https://resend.com/legal/dpa
  • Anthropic PBC — only if AI features are enabled. What they do: writes narrative commentary on figures calculated by CIP; does not train its models on your data. Data involved: the figures and context needed to write the commentary, which may include names that appear in your data (for example a supplier or customer name). Where: United States. UK transfer protection: UK Addendum (Approved Addendum) incorporated in Anthropic's DPA. Their DPA: https://www.anthropic.com/legal/dpa
  • PostHog Inc. — only for visitors and users who accept analytics. What they do: product analytics — session recordings, heatmaps, funnels and usage journeys — to help us improve CIP. Data involved: pages viewed, clicks and scrolling, device and browser type, approximate location; session recordings with every typed input hidden and, inside the signed-in app, all on-screen text hidden; a pseudonymous user id and your business's account id (never names, email addresses or figures). IP addresses are not stored. No recording of admin, sign-in, account settings, post-purchase, invitation, shared report or invoice pages. Where: EU cloud, Frankfurt, Germany; PostHog is a US company, and support or operations may involve access from the US. UK transfer protection: for storage in the EU, UK adequacy regulations for the EEA; for any access from the US, the UK Addendum incorporated in PostHog's DPA, or the UK Extension to the EU-US Data Privacy Framework if PostHog is certified. Their DPA: https://posthog.com/dpa
  • Cloudflare, Inc. (R2 object storage) — what they do: stores files uploaded to CIP, business logos, generated PDFs (such as reports and invoices) and shop templates. Data involved: the contents of those files, which may include personal data in your data (for example names on invoices or in imported spreadsheets). Where: European Union (R2 bucket under Cloudflare's EU jurisdiction setting, so the files are stored in the EU); Cloudflare is a US company, and support or network operations may involve access from other countries. UK transfer protection: for storage in the EU, UK adequacy regulations for the EEA; for any access from the US, the UK Extension to the EU-US Data Privacy Framework (Cloudflare states it is certified), with the UK Addendum as a fallback. Their DPA: https://www.cloudflare.com/cloudflare-customer-dpa/

2. Sign-in providers you choose

CIP stores sign-in data itself (sessions, passkey public keys, hashed one-time codes and authenticator-app secrets) in the Neon database above, so there is no separate authentication sub-processor. Users can, if they choose, sign in with a Google account (or a Microsoft account, where offered). Those providers are not our sub-processors: each is an independent controller of the account you hold with it, and we receive only the name and email address it confirms. Use is optional.

3. Provider for CIP's own billing

  • Stripe Payments Europe, Limited (Ireland), with Stripe, Inc. (US) — what they do: takes subscription payments from our clients and one-off payments in our templates shop. Data involved: billing contact name, email, billing address, payment method details (held by Stripe, not by CIP), transaction records. Where: Ireland (EEA) and United States. UK transfer protection: for the EEA, UK adequacy regulations; for the US, the transfer terms in Stripe's DPA and Data Transfers Addendum. Their DPA: https://stripe.com/legal/dpa

For your subscription billing, CIP is the controller (not your processor), and Stripe acts partly as our processor and partly as an independent controller (for example for fraud prevention and financial regulation). We list Stripe here so you have the full picture.

4. Get notified of changes

We give at least 30 days' notice before a new or replacement provider starts processing your data. During that time you can object (see DPA Annex 3).

  • Account owners are notified automatically by email to the owner's address on your account.
  • Anyone else (for example your data protection lead or accountant) can subscribe by emailing info@commercialintelligencepartners.co.uk with the subject line "Subscribe: sub-processor updates". To stop, use the subject "Unsubscribe: sub-processor updates".
  • Every change is also recorded in the change log below.

5. Change log

  • 26 September 2026 — first published.
  • 29 September 2026 — version 1.1: Clerk Inc. removed (CIP now stores sign-in data itself, in the database in London); Cloudflare, Inc. added for bot protection on the sign-in page; Resend's description extended to cover sign-in codes and security notices; Google (and Microsoft, where offered) described as optional sign-in providers chosen by the user.
  • {{EFFECTIVE_DATE}} — version 1.2: PostHog Inc. added (product analytics and session recordings, EU cloud in Frankfurt, only for people who accept analytics); Cloudflare, Inc. added for R2 object storage of uploaded files, logos, PDFs and templates in the EU.

6. Questions

Email info@commercialintelligencepartners.co.uk. {{COMPANY_LEGAL_NAME}}, {{REGISTERED_ADDRESS}}. ICO registration number: {{ICO_REGISTRATION_NUMBER}}.

Legal basis

UK GDPR Art. 28(2) and 28(4) (general written authorisation, notice of changes and right to object; flow-down of obligations); Chapter V UK GDPR as amended by the Data (Use and Access) Act 2025 Sch. 7; PECR reg. 6 and Sch. A1 as amended by the Data (Use and Access) Act 2025 s.112 (consent for PostHog and cip_vid); Data Protection (Adequacy) (United States of America) Regulations 2023 (SI 2023/1028) (UK Extension, in force 12 October 2023; ICO confirmed on 30 July 2026 that it operates independently of the EU's US adequacy decision); DPA 2018 Sch. 21 (EEA states treated as adequate); IDTA and UK Addendum issued under s.119A DPA 2018. Provider details reflect each provider's published DPA. We re-check each provider's DPF status on the official list at dataprivacyframework.gov at least once a year.