Definitions used in this document
- “The Service” means our TeamTrack SaaS system, which is accessed online through a web browser or by using our mobile application (App). Access is provided through a unique username/password or Microsoft/Google account.
- “your Organisation” means your company, charity or other organisation that has opened a TeamTrack account. In the relationship between us, your Organisation acts as the Data Controller as defined under the UK General Data Protection Regulation and General Data Protection Regulation.
- “us”, “we” and “our” refer to Thrive IT Ltd. In the relationship between us, Thrive IT Ltd acts as the Data Processor as defined under applicable UK and EU data protection law.
- “you” means the individual who accesses The Service on behalf of your Organisation. This may include additional users within your Organisation to whom you grant access.
Purpose of this document
This document identifies the third-party sub-processors used in connection with The Service and describes the nature of processing activities carried out by those providers.
Thrive IT Ltd engages the sub-processors listed in this document to support delivery of The Service. Your Organisation authorises the use of these sub-processors in accordance with our Terms of Service and Data Processing Agreement.
Where optional integrations are available, those sub-processors are only engaged where enabled or configured by your Organisation.
All sub-processors are engaged under written agreements containing appropriate confidentiality, security and data protection obligations in accordance with UK GDPR and EU GDPR requirements.
Nature of data processed
Depending on your Organisation’s use of The Service, sub-processors may process the following categories of data:
- User account information
- Names and contact details
- Email addresses
- Authentication and login information
- Job and scheduling data
- Uploaded documents and attachments
- Support communications
- Identity verification information
- Passport details and images
- Driving licence details and images
- Financial and banking information
- Billing and payment information
- System logs and usage metadata
Core Infrastructure and Required Service Sub-Processors
| Provider | Purpose | Location | Nature of data processed |
|---|---|---|---|
| Google Cloud | Hosting infrastructure, storage, backups and system operation | UK data centres; backups may be stored within UK or EU data centres | All customer and system data stored within the Service, including uploaded documents and backups |
| GoCardless | Direct Debit payment processing | UK/EU and international infrastructure | Billing information, payment references and banking information |
| QuickBooks | Billing, invoicing and reconciliation | UK/EU and international infrastructure | Customer billing information, invoices and payment records |
| Mailgun | Outbound email delivery services | EU and international infrastructure dependent on location | Email addresses, email content and related metadata |
Additional Support and Administration Sub-Processors
| Provider | Purpose | Location | Nature of data processed |
|---|---|---|---|
| LiveAgent | Customer support ticketing and support management | EU and international infrastructure | Names, email addresses, support communications and attachments |
| Jira | Development ticketing and support management | EU and international infrastructure | Names, email addresses, support communications and attachments |
| Slack | Internal communication system | EU and international infrastructure | Names, email addresses, support communications and attachments |
| Zoom | Virtual meetings | EU and international infrastructure | Names and email addresses |
| Microsoft Teams | Virtual meetings | EU and international infrastructure | Names and email addresses |
Optional Customer-Enabled Sub-Processors
| Provider | Purpose | Location | Nature of data processed |
|---|---|---|---|
| Microsoft Office 365 | Optional SharePoint Online job/event integration and optional Microsoft login functionality | UK/EU and international infrastructure of the customer tenant | User authentication information, linked files and related metadata |
| ClickSend | Optional outbound and inbound SMS delivery services | International infrastructure (Australia) | See the ClickSend Privacy Policy |
| HireHop | Optional equipment hire and rental services | UK/EU and international infrastructure | See the HireHop Privacy Policy |
| HireTrack NX | Optional rental services software | UK/EU and international infrastructure | See the Navigator Systems Ltd Privacy Policy |
| OnRent Events (Current RMS) | Optional equipment rental management software | UK/EU and international infrastructure | See the OnRent Events Privacy Policy |
| Xero | Optional accountancy software | UK/EU and international infrastructure | See the Xero Privacy Policy |
International Transfers
Certain sub-processors may process personal data outside the United Kingdom or European Economic Area.
Where international transfers occur, Thrive IT Ltd ensures that appropriate safeguards are implemented in accordance with UK GDPR and EU GDPR requirements, including:
- Standard Contractual Clauses (SCCs)
- UK International Data Transfer Addendum
- Applicable adequacy decisions
- Contractual confidentiality and security obligations
Retention and Deletion
Sub-processors are contractually required to delete or return personal data at the end of their services unless retention is required by applicable law.
Backup retention periods are managed in accordance with our internal retention and disaster recovery policies.
Updates to this List
We may update this sub-processor list from time to time to reflect operational, legal or technical changes.
Material changes to this list will be communicated in accordance with our Terms of Service, Data Processing Agreement and applicable data protection law.