Sub-processors
The third parties that process personal data on our behalf. Procurement-ready, dated, versioned. Cross-references the GDPR one-pager, Privacy Policy, and DPIA.
Who runs SoloCogs: SoloCogs is the brand name for the online learning platform operated by Portsdown Tuition, a sole-trader business based in Portsmouth, England. The data controller for personal data processed through SoloCogs is Portsdown Tuition.
Contact: hello@solocogs.co.uk
1. What this page is
This page lists every third party that processes personal data on our behalf as a sub-processor under UK GDPR Article 28. It is the canonical, dated, versioned reference - whenever we add, remove, or change a sub-processor, this page is updated and the version number is bumped.
Schools attaching SoloCogs to their own information register can bookmark this page; we publish material changes here at least 30 days in advance of taking effect, and notify named procurement contacts at paying schools directly.
2. Active sub-processors
The following sub-processors are active as of the "Reviewed" date above. All have a written Data Processing Agreement (DPA) with us under UK GDPR Article 28.
| Name | Purpose | Data processed | Region | DPA + privacy notice |
|---|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage, scheduled jobs. The core platform backend. | All learner + staff account data, learning activity, safeguarding records (encrypted at rest). | UK (London, eu-west-2) | DPA signed via Supabase Dashboard → Organization → Legal Documents. Privacy notice. |
| Cloudflare, Inc. | Website hosting, content delivery network (CDN), DDoS protection. | Request metadata only (IP address, request headers, geographic region). Application payloads are TLS-encrypted end to end. | Edge (global) | DPA accepted via Cloudflare Dashboard → Manage Account → Configurations. Privacy notice. |
| PayPal (Europe) S.a r.l. et Cie, S.C.A. | B2C payment processing for family and home-educator subscriptions. | Billing contact, transaction value, card / PayPal account details. No child data or learning data. | EU | PayPal acts as an independent data controller for payment data. Privacy notice. |
| Stripe Payments Europe Ltd. | B2B payment processing for school, MAT, and Local Authority invoicing. | Billing entity name, invoicing contact, transaction value. No pupil data or learning data. | EU (Ireland) | Stripe acts as an independent data controller for payment data. Privacy notice. |
| Google LLC (Google Cloud + Gemini API) | AI-assisted generation of teacher-side educational illustrations. | Educational prompts only. No student data is sent to Google. | US (with EU regional routing) | Cloud DPA incorporated by reference into the Google Cloud Terms of Service. DPA text. |
| Google LLC (Tag Manager) | Manages which client-side tags fire, gated on cookie consent. No data is sent until the cookie banner is accepted. | Tag configuration only. | Edge (global) | Google privacy notice. |
| Google LLC (Analytics 4) | Anonymised usage analytics, opt-in via cookie banner. | Page views, events, anonymised by IP truncation. No name, email, or account ID. Acts as an independent data controller. | US (with EU regional routing) | Privacy notice. |
3. Planned sub-processors
The following sub-processors are planned but not yet active. They will be moved into the "Active" table when integration goes live, with affected customers notified 30 days in advance.
| Name | Planned purpose | Data to be processed | Region | DPA + privacy notice |
|---|---|---|---|---|
| Wonde Ltd. | UK MIS aggregator. Synchronises class rosters, year groups, and (optionally, with school opt-in) SEND register entries from the school's MIS (Arbor, SIMS, Bromcom, ScholarPack, etc.). | Pupil name, year group, UPN, class membership. SEND flags only with explicit school opt-in. No safeguarding free-text is pulled. | UK | DPA + processing terms agreed at the time of go-live. Wonde privacy notice. |
4. What is not a sub-processor
Some tools we use internally never touch customer data and are therefore not listed as sub-processors:
- Internal developer tools (code editors, AI coding assistants, video editing software) - used only on our staff workstations against synthetic / test data. Production customer data is never sent to them.
- Marketing and operational tools (e.g. email newsletters to consenting subscribers) - listed in our marketing privacy notice separately, not on this page.
5. Notification of changes
When this list changes materially - a new sub-processor is added, an existing one is replaced, or a region of processing changes - we:
- Update this page with the new entry and bump the version number.
- Email named procurement / DPO contacts at all paying schools and tutoring providers at least 30 days before the change takes effect.
- Update the matching list inside the GDPR one-pager and the Privacy Policy at the same time.
Schools that wish to be on the named notification list should email hello@solocogs.co.uk with subject "Sub-processor change list".
6. Right to object
If a school or other paying customer objects in good faith to a proposed new sub-processor (for example, on data-residency or security grounds), we will engage in writing to discuss alternatives. If no acceptable alternative is reached, the school may terminate its subscription without penalty effective on the date the new sub-processor goes live. Refunds for unused prepaid time will be issued pro-rata.
Procurement and data-protection contact: hello@solocogs.co.uk. We respond to sub-processor questions, signed DPA requests, and "is X currently in use" verification queries within 3 working days.