Sub-processors
Last updated: 22 October 2026
Cambition IT Services Limited (“we”) uses the suppliers below when we process personal data for clients. A supplier applies to you only if the relevant product is on your Particulars, except X.AI LLC (Grok) and Anysphere, Inc. (Grok Bot), which we use to administer the service for all clients, and the Cambition Portal host, which applies to all clients.
We give at least 30 days' written notice of any new or replacement sub-processor under condition 11.7 of our Terms and Conditions, and you may object on reasonable data-protection grounds. Transfers outside the UK are made only under condition 11.10 (UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses).
We do not allow any AI tool to read the content of client mailboxes. The only application we authorise to access mailbox content is Acronis Microsoft 365 backup, for backup and restore only. Client data is never used to train AI models (condition 11A).
| Sub-processor | Role | Personal Data | Location | Transfer safeguard | Applies when |
|---|---|---|---|---|---|
| Relevant Giacom Group company, 41 Lothbury, London EC2R 7HF | Cloud Market provisioning and billing | Account, order, tenant and billing data | United Kingdom (Ireland if a Giacom Ireland entity is used) | None needed (UK); UK adequacy for Ireland | Any Giacom-supplied Product is on the Particulars |
| Microsoft Ireland Operations Limited / Microsoft Corporation | Microsoft 365, Exchange Online, Azure (including Azure Plan); Partner Center and GDAP administration | Identity, mailbox, file, tenant and cloud-service data | UK / EEA as provisioned; other Microsoft regions as configured | Microsoft's Data Protection Addendum | Microsoft is on the Particulars |
| Exclaimer Limited | Email signatures | Directory attributes; email in transit if server-side | Azure region selected at provision | Exclaimer's data processing terms | Exclaimer is on the Particulars |
| Bitdefender SRL | Endpoint / email security (via Giacom) | Endpoint and threat telemetry | Vendor data centre region for the Product; details on request | Bitdefender's data processing terms | Bitdefender is on the Particulars |
| Acronis International GmbH | Backup (via Giacom), including Microsoft 365 backup using Graph Mail.ReadWrite for backup and restore only | Backup content (including mailbox content) and metadata | Vendor data centre region for the Product; details on request | Acronis's data processing terms | Acronis is on the Particulars |
| N-able Technologies Ltd and N-able Solutions ULC | N-central RMM hosted by N-able on AWS (not a Cambition server); SentinelOne bolt-on supply | Device inventory, health, patch status, remote-session metadata, device usernames | N-able hosted cloud on Amazon Web Services; region details on request | N-able's data processing terms | Managed monitoring or EDR is on the Particulars |
| SentinelOne, Inc. | EDR (EU Central 1 console) | Endpoint threat telemetry | European Union (Frankfurt, AWS eu-central-1) | UK adequacy regulations for the EEA; SentinelOne's own safeguards for group support | EDR is on the Particulars |
| Gladinet, Inc. (on Amazon Web Services) | CentreStack Online hosted file access | Files, folders, permissions, access logs | United States (AWS US data centre) | UK IDTA or UK Addendum | CentreStack Online is on the Particulars |
| Microsoft Ireland Operations Limited / Microsoft Corporation (Microsoft Azure) | Infrastructure for website hosting: Cambition-managed Azure virtual machine running Cambition's WHM/cPanel server | Website files, databases, form submissions, server logs | United Kingdom (Microsoft Azure UK datacentre) | None needed (UK); Microsoft's Data Protection Addendum | Website hosting is on the Particulars |
| Hosting and telephone-network (carrier) providers for VoIP One (names available on request) | VoIP One hosted telephony (PortSIP software platform) | Extensions, numbers, call detail records, voicemail, call recordings where enabled | Details on request | Under that provider's data processing terms; any restricted transfer under condition 11.10 | VoIP One is on the Particulars |
| Hosting infrastructure provider for the Cambition Portal (crm.cambition.co.uk) (name available on request) | Cambition Portal (CRM, customer portal and ticketing) | Contacts, tickets, attachments, Device Health Reports | Details on request | Under that provider's data processing terms; any restricted transfer under condition 11.10 | All Clients |
| X.AI LLC | Grok, used by Cambition to administer the Services (condition 11A) | Data described in condition 11A.3 | United States | UK IDTA or UK Addendum | All Clients |
| Anysphere, Inc. (Cursor) | Grok Bot infrastructure (condition 11A) | As for X.AI LLC, plus Grok Bot files, session state and memory | United States | UK IDTA or UK Addendum | All Clients |
Questions about this list: Jamie Stuart, data protection lead, ambitious@cambition.co.uk, 01223 656 156. See also our Terms and Conditions (Terms and Conditions page) and Privacy and Cookie Notice (Privacy and Cookie Notice page).