Data processing agreement / Sub-processors
Sub-processors
These are the companies that process personal data for RiverCPD on our behalf, as sub-processors under our data processing agreement with your association. Last updated 19 October 2026.
Until RiverCPD v4 launches on 4 November 2026: Amazon Web Services hosts RiverCPD in its Ireland region (eu-west-1), in place of Microsoft Azure, and keeps nightly backups there for 90 days. Ireland is in the EU, which the UK recognises as giving adequate protection.
Our sub-processors
| Sub-processor | What it does for RiverCPD | Personal data it handles | Where |
|---|---|---|---|
| Microsoft Azure | Hosts RiverCPD: databases, files and backups | Everything in RiverCPD: member accounts, CPD records, evidence files, audit records | UK (UK South region) |
| Amazon Web Services (Amazon Bedrock) | Runs the AI coach and AuditAssist, using Anthropic's Claude models. Anthropic has no access to the data. | The certificate or document a member chooses and the text of their entry, with names removed | EU (AWS eu-west-1, Ireland; an EU cross-Region inference profile may use other EU regions) |
| Microsoft Azure (Communication Services) or Amazon Web Services (Amazon SES) | Sends sign-in links, reminders and notifications | Name, email address and the message | UK for Azure Communication Services; EU (AWS eu-west-1, Ireland) for Amazon SES |
| Cloudflare | Sits in front of the rivercpd.com website and the RiverCPD app. Every request passes through it, and it controls where staff can sign in from. | IP addresses, and the website and app traffic that passes through it, including members' records. Cloudflare decrypts traffic at its edge to inspect and route it, but doesn't store app pages or members' data. | Cloudflare's global network: traffic is handled at the data centre nearest the user. Covered by Cloudflare's data processing addendum, which forms part of Cloudflare's customer terms, with the standard contractual clauses and the UK Addendum, and by Cloudflare's certification under the Data Privacy Framework. |
| Microsoft 365 | Our email and documents | What you send us, for example in a support request | UK |
| Stripe | Takes payment for RiverCPD Pro | Name, email address and payment details (we never see card numbers) | UK, EEA and US; covered by Stripe's data processing agreement (the UK Extension to the EU-US Data Privacy Framework, or the standard contractual clauses with the UK Addendum) |
| Microsoft Azure (Notification Hubs) | Delivers notifications to the RiverCPD apps | A device token and the notification text | UK |
Stripe is our sub-processor only for payments we take ourselves. If your association takes payments through its own Stripe account, Stripe works for you, not us.
Senior Internet's own staff are not sub-processors. Some work outside the UK. They access RiverCPD remotely, only from the locations listed below, and only under the safeguards in clause 8 of our data processing agreement.
Adding or changing a sub-processor
We only use a sub-processor under a written contract that gives your data the same protection as our data processing agreement with you. We stay responsible to you for what our sub-processors do.
Before we add or replace a sub-processor that handles your members' data, we'll:
- update this page, and
- email the contact named in your agreement at least 7 days before the change.
If you have a reasonable data protection objection, tell us within that notice period. We'll work with you to find a solution. If we can't, you may end the affected part of the service and we'll refund any fees paid in advance for it.
To be told about changes, make sure your agreement names a data protection contact, or email dataprotection@senior.co.uk to be added.
Where our staff may access data from
Our support staff work remotely. They may access RiverCPD data only from these locations, and access from anywhere else is blocked:
- the United Kingdom
- the European Economic Area
- countries the UK recognises as giving adequate protection for personal data
- Brazil, Ghana, India, Kenya, Malaysia, Mexico, Nigeria, the Philippines, South Africa and Sri Lanka
We add a country only after assessing the risks of access from it, and we tell customers at least 30 days before. We never allow access from a country under comprehensive UK, EU or US sanctions. If you're a customer, you can ask us for a report of the countries your data was accessed from.
We complete a transfer risk assessment for a country before any of our staff there are given access, and review it every year. Staff sign-ins from any other country are blocked.