To deliver WagePerks we use a small set of trusted third-party services ("subprocessors"). This page lists every one of them, what they do, where they're based, and what data they touch.
We notify all customer admins at least 30 days before adding a new subprocessor that processes personal data. If you object to a new subprocessor on reasonable grounds, you can terminate without penalty.
Current subprocessors
| Subprocessor | What they do | Where |
|---|---|---|
| Amazon Web Services (AWS) aws.amazon.com |
Hosts the application servers, the production database (RDS for MySQL), document storage (S3), background job queue, and outbound email delivery (SES). | United Kingdom (eu-west-2) and Republic of Ireland (eu-west-1) |
| Stripe Payments UK Ltd stripe.com |
Processes subscription payments and stores card details. We never see your card number — only Stripe does. | United Kingdom (with global infrastructure) |
| Tillo Ltd tillo.io |
Wholesale supplier of digital gift cards for the Employee Benefits marketplace. We purchase each voucher from Tillo using our own working capital after your payment to Wageperks Ltd has cleared. Your contract for the voucher is with us, not with Tillo. Tillo receives the order metadata (brand slug, face value, delivery method) it needs to issue the voucher; we relay your delivery email separately when fulfilment requires it. | United Kingdom |
| Google Firebase (FCM & Crashlytics) firebase.google.com |
Cloud Messaging delivers push notifications to the mobile app — receives device tokens and the notification payload (title, body, deep-link path). Crashlytics collects mobile crash and stability diagnostics — receives crash stack traces and device / OS metadata, which may include a device identifier. | European Union / United States (Google global infrastructure, under transfer safeguards) |
| OpenStreetMap Foundation (Nominatim) openstreetmap.org |
Reverse-geocodes clock-in / clock-out locations — turns the GPS coordinates captured when an employee clocks in into a human-readable place name. Receives the latitude / longitude of a clock event; receives no name or other identifier. | European Union |
| Sentry (Functional Software, Inc.) sentry.io |
Application error and performance monitoring. Receives technical diagnostics when an error occurs (stack trace, request path, app / browser version), and may receive limited identifiers present in the error context (such as a user or account ID). | European Union / United States (under transfer safeguards) |
| GBG Group PLC (Loqate) gbgplc.com |
Provides UK address autocomplete at signup and on the profile form. Receives partial address strings as you type, returns matching addresses. | United Kingdom |
| Companies House gov.uk/government/organisations/companies-house |
Public UK government register of companies. We look up your company number at signup to sense-check it. No personal data is sent — only the registered company number. | United Kingdom |
| Starling Bank plc starlingbank.com |
Banking partner for bank-transfer payment flows in the Benefits marketplace. Receives payment metadata (amount, reference, recipient details) as required to process the transfer. | United Kingdom |
Health & Wellbeing add-on
If your employer has enabled the Health & Wellbeing add-on, the GP / EAP services are delivered by an independent third-party healthcare provider (currently HealthHero), which acts as an independent controller of any clinical / consultation data under its own terms and privacy notice. Wageperks Ltd passes only the eligibility / access data needed to make the service available. The provider may be substituted from time to time; the current provider and the personal data it receives are confirmed in the add-on's specific terms at the point of enabling it.
Internal access
Within Wageperks Ltd, customer personal data is accessed only by staff who need it to provide support, security or billing functions. All staff are bound by written confidentiality obligations. Access is logged and audited.
Notification of changes
To be notified by email when this list changes, email privacy@wageperks.com with the subject line "Subprocessor updates" and we'll add you to the notification list. The list is also versioned at the bottom of this page.
Changes
The current version is WP-SUBPROC-2026-05, effective 11 May 2026.