Orega Subprocessor List

Version 3.0
Last updated: 24 July 2026

Orega (Management) Limited uses carefully selected third-party service providers to support the delivery of its services and the operation of its business. Where these providers process personal data on Orega’s behalf, they are required to do so under appropriate written data-processing, confidentiality and security terms.

Our subprocessors

Subprocessor Purpose Personal data processed Primary processing location International transfers / safeguards
Microsoft Corporation – Microsoft 365 Email, Teams, SharePoint, OneDrive and Entra ID Emails, documents, contacts, user accounts, authentication and audit data UK / EU UK Addendum to the EU Standard Contractual Clauses or other lawful safeguards where applicable
Microsoft Corporation – Dynamics 365 Customer relationship management and sales management Customer, prospect, contact and sales records UK / EU UK Addendum to the EU Standard Contractual Clauses where applicable
HubSpot, Inc. Website CMS, marketing automation and customer relationship management Contact details, enquiries, marketing preferences and engagement data EU / USA UK Addendum to the EU Standard Contractual Clauses
OfficeRnD Ltd Workspace management, customer portal, licences, bookings and visitor administration Customer accounts, licence information, bookings, visitor information and user activity EU Standard Contractual Clauses and UK transfer safeguards where applicable
essensys plc Workspace technology, access control, Wi-Fi authentication and digital workplace services User accounts, access credentials, device identifiers and occupancy information UK Appropriate contractual safeguards where required
Technology Within Ltd – TWIIN Internet provisioning, customer connectivity and related workspace technology Customer account information, provisioning records and technical contacts UK Appropriate contractual safeguards where required
IRIS Software Group – IRIS HR / IRIS Cascade Human resources information system Employee contact details, employment records, absence, performance, salary and organisational information UK / EU UK transfer safeguards where applicable
DocuSign, Inc. Electronic signature and document execution Contracts, names, email addresses, signatures, audit trails and document content EU / USA UK Addendum to the EU Standard Contractual Clauses and other lawful safeguards
Resonate Solutions Pty Ltd Customer and employee experience platform, surveys, feedback and relationship management Names, contact details, survey responses, feedback and relationship information Primary hosting in UK / EU, with limited support access from Australia UK Addendum to the EU Standard Contractual Clauses
NorthRow / ID-Pal UK Limited Identity verification, KYC and anti-money laundering screening Names, addresses, dates of birth, identification documents, verification results and, where applicable, biometric information UK / EU Appropriate contractual and international-transfer safeguards where applicable
SafetyCulture Pty Ltd / applicable UK entity Workplace inspections, audits, incident reporting and corrective actions Employee and contractor details, inspection results, photographs, incident information and action records UK / EU or other configured regional hosting location UK Addendum to the EU Standard Contractual Clauses or other lawful safeguards where applicable
Uniti AI AI-assisted enquiry handling and customer communications Names, email addresses, telephone numbers, enquiry content and chat records UK / EU Appropriate contractual safeguards
Clay Business contact enrichment, lead intelligence and website visitor enrichment Business contact information, professional information and visitor-enrichment data USA UK Addendum to the EU Standard Contractual Clauses or other lawful safeguards
Sakari SMS messaging and customer communications Mobile numbers, message content and delivery information USA UK Addendum to the EU Standard Contractual Clauses or other lawful safeguards
Typeform S.L. Online forms and surveys Form submissions, contact details, survey responses and associated metadata EU Standard Contractual Clauses and UK transfer safeguards where applicable
Usercentrics A/S – Cookiebot Website cookie-consent management IP addresses, device identifiers, consent preferences and consent records EU Appropriate safeguards where any processing occurs outside the UK
PaperCut Software Pty Ltd Secure print management, user authentication and print accounting User accounts, authentication information, print metadata and device information UK / EU, depending on deployment Appropriate contractual safeguards where required
Sage – Sage Intacct Finance and accounting Customer, supplier and employee financial information, invoices, payments and transaction records UK / EU UK Addendum to the EU Standard Contractual Clauses or other lawful safeguards where applicable

Third parties acting as independent controllers

The following organisations may receive personal data in connection with services used by Orega but generally act as independent data controllers, rather than as subprocessors processing personal data solely on Orega’s instructions:

Organisation Purpose
Tyl by NatWest Payment processing
Stripe Payment processing, fraud prevention and regulatory compliance
WhatsApp / Meta Customer messaging and platform communications
LinkedIn Marketing, recruitment, advertising and professional networking
Google Maps Mapping and location services
YouTube Embedded video content
Vimeo Video hosting and embedded media

These organisations process personal data under their own privacy notices and legal obligations.

International transfers

Where personal data is processed outside the United Kingdom, Orega requires an appropriate transfer mechanism under Chapter V UK GDPR. Depending on the circumstances, this may include:

  • the UK International Data Transfer Agreement;
  • the UK Addendum to the EU Standard Contractual Clauses;
  • UK adequacy regulations;
  • binding corporate rules; or
  • another lawful transfer mechanism recognised under UK GDPR.

Changes to this list

Orega reviews this list regularly and may appoint new subprocessors or retire existing providers as its systems and services evolve. Where required by contract or applicable law, affected customers will be notified of material changes before a new subprocessor is engaged.