{"operator":"FIT PUP LTD","companyNumber":"15766852","lastReviewed":"2026-07-13","subProcessors":[{"name":"Hetzner","entity":"Hetzner Online GmbH (Germany)","purpose":"Hosting, compute, and storage — the infrastructure the product runs on.","dataCategories":"All product data: invoice documents, supplier records and bank details, user accounts, audit events.","location":"EU — Finland (Helsinki, HEL1-DC8)","transferBasis":"Within the EU; no third-country transfer.","status":"current"},{"name":"Cloudflare","entity":"Cloudflare, Inc. (USA)","purpose":"DNS, CDN, and TLS termination at the network edge for all inbound traffic; and Cloudflare Turnstile anti-bot verification on the public demo/contact form.","dataCategories":"Transient request data in transit (including invoice uploads) at the edge, not stored at rest; plus, for demo-form submissions, a Turnstile verification token and the visitor's IP address.","location":"Global edge; corporate entity in the USA.","transferBasis":"UK IDTA / EU SCCs as applicable for the US-established processor.","status":"current"},{"name":"Resend","entity":"Resend (USA)","purpose":"Email transport. Always: outbound transactional email (review alerts, account notifications) and delivery of website demo/contact-request emails. Optionally, for workspaces that switch on email-forwarding intake: inbound receipt of forwarded supplier invoices.","dataCategories":"Outbound alert emails: recipient email address plus alert metadata — workspace name, the invoice number and the invoice's original filename, supplier name, amount, review reason, and a review link. No invoice documents or full bank details. Website demo/contact requests: the details a visitor submits (name, work email, company, phone, invoice volume, and their answer about supplier bank-detail changes). Inbound (opt-in only): the forwarded invoice email and its attachments — invoice content that may include supplier bank details — received and stored by Resend under Resend's own retention policy (PayHQ reads them for ingestion but does not purge them from Resend afterwards).","location":"USA","transferBasis":"UK IDTA / EU SCCs as applicable.","status":"current","note":"Outbound email alerts (metadata only, no invoice documents) go through Resend whenever email notifications are enabled. Inbound email-forwarding intake via Resend is a separate, optional, opt-in interim arrangement, offered only to customers who expressly agree to it, while we build a more sovereign EU-hosted inbound path. A workspace with email notifications and inbound intake both off routes no data through Resend."},{"name":"Payee-verification providers","entity":"To be named on engagement","purpose":"Confirmation of Payee (UK) / Verification of Payee (EU) — checking a supplier account name against its bank details.","dataCategories":"Supplier name and bank-account identifiers for a single verification check.","location":"EU / UK, provider-dependent.","transferBasis":"Contracted per provider before any customer data flows; trigger-gated.","status":"planned"}],"optInTransportPaths":[{"name":"Telegram","entity":"Telegram FZ-LLC (Dubai; internationally operated infrastructure)","purpose":"A separate, optional Telegram integration — off unless a workspace switches it on. Two uses: an alert channel that posts review alerts, and an invoice-intake bot a user forwards invoices to. In both, Telegram is the transport that carries the message to PayHQ; all processing happens on our own servers, never on Telegram's.","dataCategories":"Alert channel: alert metadata only (workspace name, supplier name, amount, review reason, an invoice label such as the invoice number or original filename, and a review link). Intake bot: the invoice documents a user forwards to reach PayHQ — invoice content that may include supplier bank details. PayHQ downloads a copy for processing but does not delete the message, so the forwarded document also remains in the user's Telegram chat and Telegram's infrastructure under Telegram's own retention.","location":"International (Telegram-operated infrastructure); forwarded content is retained by Telegram under its own policy.","transferBasis":"Opt-in transport. PayHQ does not hold an Article 28 DPA or SCCs with Telegram — a workspace accepts this when it enables the integration.","status":"current","note":"Telegram is a separate opt-in module, off by default: with no Telegram integration connected, nothing is routed through Telegram. PayHQ runs no extraction, analysis, or storage of customer data on Telegram — invoices are processed only once they reach our own servers — but this is transport we do not control: PayHQ downloads the forwarded document and does not purge it, so a copy remains in the user's Telegram chat and Telegram's storage under Telegram's retention policy."},{"name":"Slack / customer-configured webhook","entity":"Slack Technologies, LLC (USA) — or another endpoint the workspace configures","purpose":"Optional alert channel — posts review alerts to a customer-configured webhook URL (typically a Slack incoming webhook), only if that channel is switched on.","dataCategories":"Alert metadata only: workspace name, supplier name, amount, review reason, an invoice label (invoice number or original filename), and a review link. No invoice documents or full bank details.","location":"USA for Slack; otherwise wherever the configured webhook points.","transferBasis":"Opt-in, workspace-chosen destination. PayHQ does not provide an IDTA/SCC transfer basis for this alert webhook — a workspace accepts that when it configures the channel.","status":"current","note":"The destination is any https/http URL the workspace enters — it is not restricted to Slack hosts in code — so where the alert metadata goes is under the workspace's control, not a fixed Slack-only path."}],"customerConnectedPaths":[{"name":"Microsoft 365 (connected mailbox)","entity":"Microsoft Corporation — the customer's own mailbox provider","purpose":"Optional mailbox intake — when a workspace connects its own Microsoft 365 mailbox, PayHQ reads new messages and their attachments to ingest invoices. Available where an operator enables the Graph connector; off by default.","dataCategories":"The connected mailbox's messages and attachments that PayHQ retrieves (invoice content, which may include supplier bank details).","location":"Provider-dependent (the customer's own tenant and region).","transferBasis":"The provider is the customer's own; PayHQ accesses it under the customer's authorisation.","status":"current","note":"Off by default and not part of the self-serve connect flow (which today provisions only email-forwarding intake via Resend). Direct Microsoft 365 mailbox reading is wired via the Microsoft Graph connector and is active for a workspace only where an operator has configured and enabled it. It remains your own mailbox provider under your own agreement — not an Article 28 sub-processor PayHQ independently engages, which is why it is listed here rather than above."},{"name":"Google / Gmail (connected mailbox)","entity":"Google LLC — the customer's own mailbox provider","purpose":"Planned mailbox intake — direct reading of a connected Google/Gmail mailbox to ingest invoices. Not yet available.","dataCategories":"The connected mailbox's messages and attachments that PayHQ would retrieve (invoice content, which may include supplier bank details).","location":"Provider-dependent (the customer's own tenant and region).","transferBasis":"The provider is the customer's own; PayHQ would access it under the customer's authorisation.","status":"planned","note":"On our roadmap and not available today; no Google/Gmail mailbox is read. When it ships it will be off by default and remain your own mailbox provider under your own agreement — not an Article 28 sub-processor PayHQ independently engages."}]}