Sub-processors
Last updated: 29 April 2026
TinyTax Ltd ("we") engages the third-party service providers listed below to deliver the TinyTax service. Each is bound by a written agreement with terms equivalent to those in our Data Processing Agreement and processes Personal Data only on our documented instructions.
This list applies to the TinyTax service. We update it before authorising any new sub-processor. See the change notification regime at the bottom of this page.
Current sub-processors
| Sub-processor | Role | Country | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH | Primary hosting (web, application database, file storage) and primary outbound email relay | Germany (Falkenstein) | UK adequacy regulations (EEA) |
| OVHcloud | Staging environment (sandboxed test data; production data only when explicitly seeded for support investigation) | France (Gravelines) | UK adequacy regulations (EEA) |
| DreamHost | Fallback outbound email relay; encrypted off-site database backups | United States | UK International Data Transfer Agreement / UK Addendum to EU SCCs |
| Stripe Payments Europe Ltd | Subscription and one-off payment processing | Ireland (controllerships); United States (group) | UK adequacy (IE); UK IDTA / SCCs for any US transfer. Stripe acts as an independent Controller for payment data. |
| Anthropic, PBC | AI model provider for the support agent — processes inbound support ticket subject and body when generating proposed replies and KB matches | United States | UK IDTA / SCCs |
| Google LLC | Google Sign-In (OAuth identity); server-side conversion uploads to Google Ads (hashed email and click identifier only) | United States | UK IDTA / SCCs |
| Microsoft Corporation | Server-side conversion uploads to Microsoft Ads (hashed email and click identifier only) | United States | UK IDTA / SCCs |
| Meta Platforms Ireland Ltd | Conversions API (server-side) and Pixel (browser-side) for advertising measurement (hashed email and event identifiers only) | Ireland (controllerships); United States (group) | UK adequacy (IE); UK IDTA / SCCs (US) |
Statutory recipients (not sub-processors)
The following organisations receive your data when you instruct us to make a statutory submission. They act in their own right under the Companies Act 2006 and Finance Acts and are not sub-processors:
- HM Revenue & Customs (HMRC) — receives CT600 returns and supporting iXBRL accounts and computations.
- Companies House — receives annual accounts and confirmation statements.
Change notification
We will notify you at least 14 days in advance of any change to this sub-processor list — either a new sub-processor or the removal of an existing one. Notifications are posted on this page; you can check back periodically or watch for changes via your preferred means.
If you object to a new or replacement sub-processor on legitimate data-protection grounds, please contact within 14 days of the notice. Where a service cannot be provided without the affected sub-processor, you may terminate the affected portion of the service and receive a refund for any unused prepaid period.
Contact
For questions about this list or our data processing, email .