We believe in transparency about who processes data on our behalf. Below is our current list of subprocessors. We will notify account holders of any changes with at least 14 days' notice.
Our Subprocessors
CentreFlow uses a limited number of carefully selected third-party providers to deliver the platform. All subprocessors are required to provide appropriate data protection guarantees under UK GDPR.
Secure cloud infrastructure
Purpose: Cloud application hosting, authentication, database infrastructure and secure platform operations.
Data categories: Student records, parent information, staff records, attendance data, operational platform data and communications.
Location: UK / EU
Current infrastructure provider: Base44.
GoCardless
Purpose: Direct debit and payment collection on behalf of tuition centres
Data categories: Payee names, email addresses, bank account references, mandate status, and payment history
Location: UK / EEA
Email Delivery Provider (TBC)
Purpose: Transactional email delivery including invoice emails and system notifications
Data categories: Recipient email addresses and email content
Location: UK / EEA
Twilio / SMS Provider (TBC)
Purpose: Optional SMS notifications for parent communications (where configured)
Data categories: Parent or guardian mobile phone numbers and message content
Location: UK / EEA
Hosting Infrastructure
Purpose: Cloud server infrastructure underpinning the CentreFlow platform
Data categories: All data processed within the platform (encrypted at rest and in transit)
Location: EU/UK
Analytics Provider (TBC)
Purpose: Anonymised product usage analytics to improve the CentreFlow platform
Data categories: Anonymised usage events — no personal identifiers are shared
Location: UK / EEA
Notification of Changes
When we add, remove, or materially change a subprocessor, we will notify all active account holders by email at least 14 days before the change takes effect. Account holders who object to a new subprocessor may exercise their right to terminate their subscription without penalty during this notice period.
Questions
For questions about our subprocessors or data processing arrangements: privacy@centreflow.co.uk