How we protect your data
A written agreement for every client
Every Business-PRO contract includes our Data Processing Addendum, written to meet Article 28 of UK GDPR.
30 days’ notice of changes
We tell clients at least 30 days before we add or replace a sub-processor, so you have time to raise any concerns.
UK and EU hosting first
Where a platform offers a UK or European region, we use it. Most of the data we process stays in the UK or the European Union.
24-hour breach notification
If a personal data breach affects your data, we tell you within 24 hours of becoming aware of it.
Rubicon IT is Cyber Essentials Plus certified
An independent assessor has tested our own systems against the UK Government’s Cyber Essentials scheme, including hands-on checks of our devices, patching and access controls. We renew it every year.
Certificate number b615365c-a514-4810-88f8-b01f0f7f0fa2 | Valid until
Current sub-processors
Where a provider holds data outside the UK, we rely on a recognised safeguard. UK law treats the European Economic Area, Canada, Israel and New Zealand as adequate, and for certified US providers the UK Extension to the EU-US Data Privacy Framework applies.
Device management and support
| Sub-processor | What they do for us | Data location | Transfer safeguard |
|---|---|---|---|
| Addigy, Inc. | Mac device management, updates and remote support | United States | UK Extension to the EU-US Data Privacy Framework |
| NinjaOne, LLC | Windows device management, monitoring and remote support | European Union | UK adequacy (EEA) |
Security
| Sub-processor | What they do for us | Data location | Transfer safeguard |
|---|---|---|---|
| SentinelOne, Inc. | Endpoint detection and response and our 24/7 security operations centre | European Union | UK adequacy (EEA) |
| Guardz Ltd | Email protection, security awareness training and dark web monitoring | European Union | UK adequacy (EEA and Israel) |
| DNSFilter, Inc. | Web filtering on managed devices | United States | Standard contractual clauses with the UK Addendum |
| Augmentt | SaaS discovery and Microsoft 365 and Google security reporting | European Union | UK adequacy (EEA and Canada) |
| 1Password (AgileBits Inc.) | Business password manager (vaults are end-to-end encrypted) | European Union (Germany) | UK adequacy (EEA) |
Backup
| Sub-processor | What they do for us | Data location | Transfer safeguard |
|---|---|---|---|
| NinjaOne, LLC | Google Workspace and Microsoft 365 backup | European Union | UK adequacy (EEA) |
| NinjaOne, LLC | Workstation backup | European Union | UK adequacy (EEA) |
Service desk and documentation
| Sub-processor | What they do for us | Data location | Transfer safeguard |
|---|---|---|---|
| Kaseya (Autotask) | Service desk ticketing and contract records | United Kingdom | No transfer outside the UK |
| Kaseya (IT Glue) | IT documentation for your environment | European Union | UK adequacy (EEA) |
Our own systems
| Sub-processor | What they do for us | Data location | Transfer safeguard |
|---|---|---|---|
| Microsoft Corporation | Our email, Teams and phone system, including support correspondence | Europe, moving to the United Kingdom | UK adequacy (EEA) |
| Google LLC | Our Google Workspace, including documents and correspondence about client work | Europe (stored data) | UK adequacy (EEA) |
| Egnyte, Inc. | Our file storage for client documents | European Union | UK adequacy (EEA) |
What isn’t on this list
Platforms you contract for directly, such as your own Google Workspace, Microsoft 365, Apple Business Manager or AWS accounts, are your processors rather than ours. We administer them for you under your agreements with those providers.
The systems we use to run our own business, such as our CRM and accounts software, aren’t sub-processors either. We act as the controller for that information, and our privacy notice explains how we handle it.
A few tools we supply to individual clients only, such as specialist training or security platforms, appear in that client’s own Data Processing Addendum rather than here.
What is a sub-processor?
A third party we engage that processes personal data on your behalf while we deliver our services, such as our device management or backup platforms.
Can I object to a new sub-processor?
Yes. If you have reasonable data protection grounds, tell us within the 30-day notice period and we’ll work through it with you, as set out in our Data Processing Addendum.
Where can I see your security measures?
Our Data Processing Addendum includes a summary of our technical and organisational measures. We’re happy to send it across, along with our suppliers’ SOC 2 and ISO 27001 information where they publish it.
Get notified of changes
Clients with a Data Processing Addendum hear from us automatically. Anyone else can sign up here and we’ll email you whenever this list changes.
Questions about how we handle data?
Email hello@rubicon-it.co.uk or call 0800 007 3040 and we’ll put you through to the right person.