Subprocessor register

Sanderson x Holdings Ltd trading as Arxela Property Management uses the following providers to process customer service data. The processing location describes the principal configured location or provider operation; authorised support, resilience and security processing may occur elsewhere under the stated safeguards.

Where Arxela is a processor for a landlord or organisation, these providers act as subprocessors. Where Arxela is controller for account, security or communication data, they act as our processors.

Purpose: application hosting, content delivery, deployment, serverless execution and operational/security logs.

Data: requests, IP and device metadata, application payloads handled during a request, account identifiers and error/diagnostic information.

Location and safeguards: global edge infrastructure and provider operations including the United States. Provider DPA, applicable adequacy arrangements and UK transfer clauses or Addendum safeguards are used as required.

Purpose: documented production PostgreSQL database, private object storage and scoped delivery of generated documents and uploaded evidence.

Data: account, contact, property, tenancy, compliance, maintenance, communication, finance, audit and workflow records; tenancy and agreement documents, compliance evidence, maintenance photographs and files, invoices and storage metadata.

Location and safeguards: the documented production project is configured in London (`eu-west-2`). Provider DPA and applicable UK transfer safeguards cover authorised processing outside the UK. Current account evidence must be completed before public signup.

Purpose: restricted retention of a frozen pre-cutover PostgreSQL copy while its documented migration-evidence or legal-hold purpose remains. It is not used for current application writes or recovery.

Data: the account, property-management and workflow data present at cutover; no later Supabase writes or Storage objects.

Location and safeguards: account location and current retention terms are being reconfirmed. Provider DPA and applicable UK transfer safeguards apply while the copy remains retained.

Purpose: transactional email delivery.

Data: recipient and sender email addresses, subject, message content, delivery status and related metadata. Arxela does not enable email tracking for advertising.

Location and safeguards: United States and Resend’s listed subprocessors. Resend’s DPA incorporates UK transfer safeguards and identifies its subprocessor chain.

Purpose: bot, fraud and abuse prevention on public landlord signup.

Data: reCAPTCHA token, IP address where supplied, browser/device and interaction signals, and verification result.

Location and safeguards: Google’s global infrastructure. From 2 April 2026, Google processes reCAPTCHA Customer Data as processor under the Google Cloud Terms and Cloud Data Processing Addendum. Applicable adequacy and transfer safeguards are used where required.

We will update this register before a new provider processes live Customer Personal Data. Customers covered by the Data Processing Agreement will receive at least 15 days’ notice where reasonably practicable and may object on reasonable data-protection grounds. Urgent security, continuity or legal changes may be notified as soon as practicable.

To request change notifications or ask about a provider, email hello@arxela.co.uk from the account owner’s address.

OpenAI or another AI model provider, Twilio, Plaid or another open-banking provider, Zoho Sign or another e-sign provider, Stripe, analytics/advertising products, listing platforms, referencing providers, deposit providers and contractor-directory marketplaces are not current live Customer Personal Data subprocessors. This register and the Privacy Policy will be updated before any such provider is activated.