ÌÇÐÄVlog´«Ã½

Platform Sub-processors and Technical Partners

Webanywhere Ltd engages the following internal group companies and third-party sub-processors. Each partner is selected for their technical capabilities and their ability to support our compliance with the UK GDPR and the Data Protection Act 2018.

Webanywhere Group Operations

Webanywhere & Venturesanywhere Group

Technical assistance, maintenance, and software development are provided by our internal teams, which include both employees and contractors. Access to system data is strictly limited to support and maintenance purposes.

• Location: United Kingdom (Webanywhere Ltd / Venturesanywhere Ltd), Poland (Webanywhere sp. z o.o. / Venturesanywhere sp. z o.o.), and the USA (Webanywhere Inc.).
• Safeguards: Internal Data Processing Agreements (IDPAs), confidentiality agreements.
• Applicable Systems: ÌÇÐÄVlog´«Ã½ 3 CMS, ÌÇÐÄVlog´«Ã½ 3 Mobile App

Operational Platforms

Google Workspace (Gmail, Calendars, Drive, Meets, etc)

Google Workspace provides the corporate email infrastructure, internal document management, and cloud storage solutions.

• Location: United States, European Union, and Global data centres.
• Safeguards: UK-US Data Privacy Framework (DPF), Standard Contractual Clauses (SCCs), and ISO 27001 certification.
• Applicable Systems: Webanywhere Internal Operations, Corporate Communications, Project Documentation, ÌÇÐÄVlog´«Ã½/Webanywhere Additional Operational Services.

Atlassian (Jira, etc)

Atlassian provides the project management, issue tracking, and workflow automation infrastructure.

• Location: Primarily the EU and Global data centres.
• Safeguards: UK-US Data Privacy Framework (DPF), Standard Contractual Clauses (SCCs), ISO 27001, and SOC 2 Type 2 certification.
• Applicable Systems: Webanywhere Internal Operations, Development Tracking, Customer Issue Management., ÌÇÐÄVlog´«Ã½/Webanywhere Additional Operational Services.

OpenAI, L.L.C. (e.g., ChatGPT, DALL-E, etc)

OpenAI provides Large Language Model (LLM) APIs that power the AI-assisted text editing, rewriting, translation, image analysis, and content generation tools available to staff.

• Location: United States / Dublin, Ireland.
• Safeguards: Configured via enterprise API with Zero Data Retention (ZDR) and Data Training disabled; UK Addendum to the Standard Contractual Clauses (SCCs).
• Applicable Systems: ÌÇÐÄVlog´«Ã½ 3 CMS, Webanywhere Internal Operations, ÌÇÐÄVlog´«Ã½/Webanywhere Additional Operational Services.

Google LLC / Google Cloud EMEA (e.g., Gemini, Vertex AI, etc)

Google Cloud provides application infrastructure, data hosting, business email, and Vertex AI/Gemini Enterprise APIs for specific AI processing workflows.

• Location: Dublin, Ireland (EU Region) and the United States (for specific AI processing).
• Safeguards: Local EU hosting, UK-US Data Bridge (Data Privacy Framework), and Standard Contractual Clauses (SCCs).
• Applicable Systems: ÌÇÐÄVlog´«Ã½/Webanywhere Additional Operational Services.

Amazon Web Services, Inc. (e.g., AWS AI Services, etc)

AWS provides the primary cloud hosting infrastructure, S3 data storage, database management, network firewalls, and AWS AI services.

• Location: London (UK), Dublin (Ireland), and Frankfurt (Germany), with the USA used for specific global delivery.
• Safeguards: Local UK/EU data residency, ISO 27001 certification, full encryption at rest and in transit, and Standard Contractual Clauses (SCCs).
• Applicable Systems: ÌÇÐÄVlog´«Ã½ 3 CMS, ÌÇÐÄVlog´«Ã½ 3 Mobile App, ÌÇÐÄVlog´«Ã½/Webanywhere Additional Operational Services.

ElevenLabs Inc. (e.g., Audio Synthesis, etc)

ElevenLabs provides the AI engines for voice synthesis, text-to-speech rendering, and multilingual audio translation.

• Location: United States.
• Safeguards: Standard Contractual Clauses (SCCs).
• Applicable Systems: ÌÇÐÄVlog´«Ã½ 3 CMS, ÌÇÐÄVlog´«Ã½/Webanywhere Additional Operational Services.

Adobe Inc. (e.g., Adobe Firefly, Image Synthesis, etc)

Authorized AI sub-processor utilized for AI services (such as automated image processing or media generation).

• Location: Primarily the United States.
• Safeguards: UK-US Data Bridge (Data Privacy Framework) and/or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (SCCs).
• Applicable Systems: ÌÇÐÄVlog´«Ã½/Webanywhere Additional Operational Services.

Figma, Inc. (e.g., Figma AI, Design Synthesis, etc)

Authorized AI sub-processor utilized for AI-assisted design services.

• Location: Primarily the United States.
• Safeguards: UK-US Data Bridge (Data Privacy Framework) and/or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (SCCs).
• Applicable Systems: ÌÇÐÄVlog´«Ã½/Webanywhere Additional Operational Services.

Canva Pty Ltd (e.g., Canva AI, Design Synthesis, etc)

Authorized AI sub-processor utilized for AI-assisted design and media services.

• Location: Primarily the United States.
• Safeguards: UK-US Data Bridge (Data Privacy Framework) and/or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (SCCs).
• Applicable Systems: ÌÇÐÄVlog´«Ã½/Webanywhere Additional Operational Services.

Core Platform Infrastructure

Amazon Web Services (AWS)

AWS provides our primary cloud hosting, database management, and secure data storage. This is where the core student and parent records are maintained.

• Location: London (UK) and Dublin (Ireland).
• Safeguards: Local data residency, ISO 27001 certification, and full encryption at rest and in transit.
• Applicable Systems: ÌÇÐÄVlog´«Ã½ 3 CMS, ÌÇÐÄVlog´«Ã½ 3 Mobile App

Amazon SES

Simple Email Service (SES) is used for the delivery of high-volume platform communications, such as school newsletters.

• Location: UK and EU regions.
• Safeguards: Local data residency and UK GDPR-compliant processing terms.
• Applicable Systems: ÌÇÐÄVlog´«Ã½ 3 CMS.

Amazon SNS

Simple Notification Service (SNS) is used for the delivery of high-volume platform communications via mobile channels, such as iOS and Android push notifications.

• Location: UK and EU regions.
• Safeguards: Local data residency and UK GDPR-compliant processing terms.
• Applicable Systems: ÌÇÐÄVlog´«Ã½ 3 CMS, ÌÇÐÄVlog´«Ã½ 3 Mobile App

Google Firebase

Firebase manages user authentication (logins) and administrative lifecycle emails such as password resets.

• Location: United States.
• Safeguards: UK-US Data Privacy Framework (DPF), Standard Contractual Clauses (SCCs), and SOC 2 Type 2 certification.
• Applicable Systems: ÌÇÐÄVlog´«Ã½ 3 CMS, ÌÇÐÄVlog´«Ã½ 3 Mobile App

OpenAI

OpenAI powers the AI-assisted text editing and content generation tools available to staff within the CMS.

• Location: United States.
• Safeguards: Configured via API with Zero Data Retention and Data Training disabled; UK Addendum to the Standard Contractual Clauses (SCCs).
• Applicable Systems: ÌÇÐÄVlog´«Ã½ 3 CMS

Mobile, Mapping & Translation

Apple (APNs) & Google (FCM)

These are the native infrastructure services used to deliver push notifications to iOS and Android devices respectively.

• Location: United States.
• Safeguards: Technical infrastructure services; processing is limited to anonymised device tokens required for message routing.
• Applicable Systems: ÌÇÐÄVlog´«Ã½ 3 CMS, ÌÇÐÄVlog´«Ã½ 3 Mobile App

OpenStreetMap

This service is used to render real-time map tiles within the platform.

• Location: EU and Global.
• Safeguards: Limited to map tile requests; no student or parent PII is shared or stored.
• Applicable Systems: ÌÇÐÄVlog´«Ã½ 3 CMS

GetTheData

Used to perform postcode lookups to provide geographical context and address validation within the platform.

• Location: United Kingdom.
• Safeguards: Processing is limited to the postcode entered; no identifying user data or PII is transmitted to the service.
• Applicable Systems: ÌÇÐÄVlog´«Ã½ 3 CMS

Google Translate

Provides a gateway for automated website translation into multiple languages at the user’s request.

• Location: Global.
• Safeguards: Processing is transient and performed in real-time; ÌÇÐÄVlog´«Ã½ does not store the resulting translated data.
• Applicable Systems: ÌÇÐÄVlog´«Ã½ 3 CMS

System Integration

Groupcall Ltd (Xporter)

A technical system-to-system integration used to synchronise selected information from the school’s Management Information System (MIS) to establish parent-pupil relationships.

• Location: United Kingdom.
• Safeguards: A triangular set of agreements between the School, Groupcall, and Webanywhere. The school acts as the Controller, explicitly authorising data categories with the ability to revoke access at any time.
• Applicable Systems: ÌÇÐÄVlog´«Ã½ 3 CMS, ÌÇÐÄVlog´«Ã½ 3 Mobile App

Platform-Integrated Modules (Optional)

The ÌÇÐÄVlog´«Ã½ CMS includes dedicated modules that schools may choose to activate. Depending on the feature, these may use direct API integrations (where our servers fetch data for display) or embedded widgets (where the user’s browser connects directly to the provider).

Social Media API Integrations (Instagram, etc.)

Where a school utilises our dedicated social media modules, such as Instagram or Facebook, the platform may connect to third-party APIs to fetch and reformat content (such as an Instagram feed) to match the website’s design. Webanywhere acts as the technical bridge, fetching public or authorised content on behalf of the school. 

• Location: USA / Global.
• Safeguards: Standard Contractual Clauses (SCCs) and API-specific developer terms provided by the social networks.
• Applicable Systems: ÌÇÐÄVlog´«Ã½ 3 CMS

Embedded Media Elements

The CMS provides specific elements for the direct embedding of content such as YouTube, Vimeo, Facebook, and Twitter (X). These function using “iframes,” meaning the user’s browser establishes a direct connection to the provider’s servers. These providers may set tracking cookies and collect information as independent Data Controllers.

• Location: USA / Global.
• Safeguards: Controlled by the provider’s global privacy policies and the School’s own data practices.
• Applicable Systems: ÌÇÐÄVlog´«Ã½ 3 CMS

Google Analytics Integration

The platform provides an optional dedicated field for schools to integrate their own Google Analytics tracking ID.

• Location: USA / Global.
• Safeguards: Controlled by the school’s own Google account settings; data is processed under Google’s global privacy terms.
• Applicable Systems: ÌÇÐÄVlog´«Ã½ 3 CMS

MyNewTerm Recruitment Portal

A pre-built integration that allows schools to display job vacancies directly on their website.

• Location: United Kingdom.
• Safeguards: Direct service agreement between the School and MyNewTerm.
• Applicable Systems: ÌÇÐÄVlog´«Ã½ 3 CMS

General School Content & Embeds

Custom Third-Party Embeds & Code

Beyond the pre-built modules listed above, the ÌÇÐÄVlog´«Ã½ CMS allows school staff to potentially include custom code, iframes, or widgets from any third-party provider (e.g. external monitoring, 3rd party surveys or booking systems etc) (subject to technical compatibility with the CMS).

• Security & Oversight: While Webanywhere Ltd may restrict certain types of code for security or operational purposes, we make no guarantee to monitor, check, or vet custom code or third-party widgets included by the school.
• Responsibility: The school is solely responsible for vetting these providers and ensuring they have a lawful basis for processing. Webanywhere Ltd does not maintain technical nor legal oversight of custom code or scripts included by the school.
• Applicable Systems: ÌÇÐÄVlog´«Ã½ 3 CMS