1.Platform sub-processors
| Provider | Service | Personal data categories | Processing location |
|---|---|---|---|
| Tendr Limited | Underlying Platform technology, App and Employer Hub hosting, support, security, authentication, benefit workflows, reporting, operational services and associated infrastructure | Employee, employer-admin, payroll, benefit, order, usage, technical, content, support and other Platform data processed for the relevant employer | United Kingdom primary hosting, with Tendr's downstream processing locations as described in its current register |
Tendr engages its own downstream sub-processors to deliver the Platform – including cloud hosting, payment processing, open-banking, gift-card fulfilment, analytics, email-delivery and finance providers. Their current details, locations and transfer safeguards are set out in Tendr’s Platform Privacy Notice and Sub-processor List.
Perky currently uses Tendr’s payment and open-banking accounts (Stripe and TrueLayer), so these are covered within the Tendr Platform layer above. If Perky opens its own payment or open-banking accounts in future, they will be added here as Platform sub-processors and the 14-day client-notice will apply.
2.Perky service providers
These providers primarily support Perky’s controller-side activities, including the public website, prospective-client enquiries, demo bookings, sales, onboarding, contracts, invoices, marketing and internal operations.
| Provider | Service | Personal data categories | Main processing location |
|---|---|---|---|
| Vercel Inc. | Website and onboarding-app hosting, content delivery, serverless functions, scheduled tasks and storage of generated onboarding PDFs | Website visitor technical data; onboarding contact, employer and signatory details; implementation and payroll details included in onboarding documents | Global infrastructure; data region configurable |
| Neon Inc. | Production PostgreSQL database for onboarding records | Onboarding contact details, employer information, signatory details, plan selection and free-text onboarding information | AWS London region |
| Sendinblue SAS trading as Brevo | Transactional email, newsletter and marketing-email delivery | Names, email addresses, communication preferences, email content and attachments | European Economic Area |
| HubSpot, Inc. | CRM, sales pipeline, marketing forms and contact/company management | Lead names, work emails, phone numbers, employer information, form submissions and CRM activity | European data residency where configured; provider operations may involve other locations |
| Microsoft Corporation and Microsoft Ireland Operations Ltd | Entra ID, staff identity, SSO, Microsoft 365 email and business collaboration | Staff identities, work contact details and business communications that may include client-contact information | European data boundary where configured; provider operations may involve other locations |
| Slack Technologies, LLC | Internal alerts relating to website forms, newsletters, trials and onboarding submissions | Form-submission alerts that may include names, emails, employer information and enquiry details | United States |
| Calendly LLC | Demo booking and meeting scheduling | Invitee names, email addresses, meeting preferences and scheduling data | United States |
| DocuSign, Inc. | E-signature of client agreements | Signatory name, email address, title, signature and contract metadata | European service availability; provider operations may involve other locations |
| PostHog, Inc. | Product analytics, error reporting and consented session replay | Pseudonymous identifiers, IP address, device and browser data, website usage, technical error details and masked replay information | European cloud region (Frankfurt where configured) |
| Google LLC and Google Ireland Ltd | Google Analytics 4 and Google Tag Manager | Cookies, online identifiers, IP address, device and browser information, website usage and conversion information | Global |
| LinkedIn Ireland Unlimited Company and LinkedIn Corporation | LinkedIn Insight Tag, advertising measurement and conversion tracking | Online identifiers, IP address, advertising cookies and website conversion data | European Union and United States |
| Contentsquare SAS | Digital-experience analytics | Cookies, online identifiers, device information and website-behaviour data | European Economic Area |
| Storyblok GmbH | Headless CMS for website and marketing content | Limited author/editor account details and content-management data | European Economic Area |
| FreeAgent Central Ltd | Accounting and financial administration | Client contact details, invoice details, payment and accounting records | United Kingdom |
3.Benefit, payment, card and fulfilment recipients
Depending on the benefit selected, Perky may share the minimum necessary personal data with the relevant provider, retailer, issuer, aggregator, fulfilment partner, broker or insurer. These organisations may act as independent controllers under their own privacy notices, terms and retention policies. Current examples include:
| Benefit or service | Possible provider or recipient |
|---|---|
| Technology and mobile | Currys Business, AO Business, Amazon Business, Technical Reality Limited and alternative suppliers where required |
| Cycle scheme | Bike2Work |
| Lifestyle subscriptions and gift cards | Tendr Limited, Tillo, Runa, NeoCurrency and Blackhawk |
| Childcare | YellowNest |
| Eldercare funding and support | Lottie |
| Payroll Giving | GoodPAYE and PayCaptain |
| Electric vehicles | Octopus, Love Electric, Tusker or another provider selected by the employer |
| EV charging | Octopus |
| Home, garden, furniture and household appliances | John Lewis, IKEA, AO Business and Currys Business |
| Retail discounts, cinema, vouchers, cards and other card-based services | Relevant provider, retailer, gift-card aggregator, payment provider, card issuer or programme manager made available through the Platform |
Payment and banking. Our bank, Mettle (a NatWest Group brand), receives client billing and payment information to process payments to Perky. It acts as an independent controller for the banking relationship and is not a Perky sub-processor.
Availability of specific benefits and providers can vary by employer configuration, product availability, provider requirements and location. We may update this list where providers are added, changed or removed.
4.International transfers
Some providers process or access personal data outside the United Kingdom. Where a transfer is restricted under applicable data-protection law, Perky uses an appropriate transfer mechanism, including UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, the UK extension to the EU–US Data Privacy Framework where the provider is certified, or another lawful safeguard.
5.Questions and objections
For questions about this list, contact support@perkybenefits.co.uk. Where you are an employer client and have a reasonable data-protection objection to a proposed new Platform sub-processor, please contact Perky promptly using the process in your Data Processing Agreement.