Legal

Sub-processors

Every third party that can touch personal data in ClientTurn: what it does, what it sees, where it processes it and how transfers out of the UK are protected.

Version: 28 September 2026
In force from: 28 September 2026
Governing law: England and Wales

Who you are contracting with

ClientTurn is a trading name of Blackwellen Limited, a private company limited by shares registered in England and Wales under company number 16482166.

Registered office: 61 Bridge Street, Kington, Herefordshire, HR5 3DJ, United Kingdom. This is also our address for service of formal notices.

Support: support@clientturn.com · Legal, data protection and formal notices: legal@clientturn.com. These are the only two mailboxes we operate.

Blackwellen Limited is not currently registered for VAT. No VAT is charged on our invoices, and none may be reclaimed on them. We will publish our VAT number here and begin charging VAT from the date registration takes effect.

1. About this register

A sub-processor is a third party we engage to process personal data on behalf of our customers. Article 28(2) and 28(4) of the UK GDPR require us to have our customers’ authorisation to use them, to bind each one to obligations no less protective than our own, and to remain fully liable to the customer for what they do.

This page is that register. It is referenced by our Privacy Policy, which contains our Article 28 processing terms, and by clause 16 of our Terms of Service.

We keep this list deliberately short. A provider is added only where it is genuinely needed to run the service, and it appears here the moment it can touch customer or lead personal data in production.

2. Core sub-processors

Engaged for every workspace. These are the providers that make the service work at all.

Provider	Contracting entity	What it does	Personal data it can see	Processing location	Transfer mechanism
Supabase	Supabase, Inc. (United States), operating the EU-hosted platform	Primary application database, authentication and file storage. Holds workspace accounts, leads, messages, qualification answers and audit records.	Account data; lead contact details; message content and delivery status; qualification answers; audit logs.	London, United Kingdom (eu-west-2)	Data at rest remains in the United Kingdom. Provider support access from the United States is covered by the UK International Data Transfer Addendum.
Vercel	Vercel, Inc. (United States)	Hosting and delivery of the application and marketing site, including request routing, function execution and short-lived operational logging.	IP address, request metadata, and any personal data contained in a request or response while it is in transit.	United States (primary compute), with a global edge network	UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
Stripe	Stripe Payments Europe, Limited (Ireland) and Stripe, Inc. (United States)	Subscription billing, checkout, card processing, invoicing and tax calculation. Card details are entered into Stripe-hosted fields and never reach our servers.	Billing name, billing address, email address, VAT status, payment method tokens, invoice and transaction records.	European Union and United States	EU Standard Contractual Clauses with the UK Addendum.
Cloudflare R2	Cloudflare, Inc. (United States) and Cloudflare Limited (United Kingdom)	Object storage for workspace logos, uploaded CSV import files, support attachments, quote and invoice PDFs and, where voice recording is turned on, call recordings; and network protection in front of the site. Stored files are served only through short-lived signed URLs.	Uploaded logo images; CSV import files, which may contain contact names, phone numbers and email addresses; support attachments; quote and invoice PDFs (names, addresses, prices); call recordings where enabled; network request metadata.	European Union jurisdictional restriction applied to stored objects	UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
Twilio	Twilio Ireland Limited and Twilio Inc. (United States)	Delivery of outbound SMS and WhatsApp messages and receipt of inbound replies, including delivery receipts and opt-out keywords. Where a customer turns on the AI Voice Sales Agent, also the dedicated phone number and the telephone connection for its calls.	Recipient phone number, message body, timestamps, delivery status, and the content of inbound replies; for voice, call metadata (numbers, times, duration) and the call audio in transit.	Ireland and United States	EU Standard Contractual Clauses with the UK Addendum.
Retell AIOnly if enabled	Retell AI, Inc. (United States)	Runs the AI Voice Sales Agent's calls: speech recognition, the voice, and the real-time connection between the call and ClientTurn's agent. Only used when a customer turns voice on.	The lead's phone number, the live call audio, the call transcript and, where the customer turns recording on, the call recording.	United States, hosted on Amazon Web Services US regions (Retell AI's privacy policy: data is primarily stored and processed in the United States).	UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, under Retell AI's data processing agreement.
Resend	Plus Five Five, Inc. trading as Resend (United States)	Transactional email: sign-in and verification messages, billing notices, product notifications, and follow-up email to leads where email follow-up is configured.	Recipient name and email address, message body, delivery and bounce status.	United States	EU Standard Contractual Clauses with the UK Addendum.
Microsoft Azure OpenAI ServiceOnly if enabled	Microsoft Ireland Operations Limited	Optional AI assist. Classifies the intent of an inbound reply and extracts a candidate answer to a question the customer has already configured. It never composes a price, quote, availability or service-area commitment, and the deterministic rules always make the decision.	The text of an inbound message and the configured question it is being matched against.	European Union (EU data boundary; customer data is not used to train models)	UK adequacy regulations for the European Economic Area.
Google PlacesOnly if enabled	Google Ireland Limited (Google Maps Platform)	Company discovery for Find Leads: finds businesses matching the customer's search (industry and area) so their own websites can be read. Only used when a customer runs a Find Leads search.	The search terms (business type and location). No lead or contact personal data is sent. Only the place identifier and the company's website domain are kept.	European Union and United States	EU Standard Contractual Clauses with the UK Addendum, under the Google Maps Platform terms.

3. Customer-enabled providers

These receive data only where a customer connects the integration or turns the feature on. Connecting one is an instruction from the customer, as controller, to disclose data to that provider; use of it is then governed by the customer’s own agreement with them as well as by ours.

Provider	Contracting entity	What it does	Personal data it can see	Processing location	Transfer mechanism
Meta Lead AdsOnly if enabled	Meta Platforms Ireland Limited	Source of the leads a customer receives. Meta delivers lead form submissions and campaign attribution fields for the pages and forms the customer connects.	Lead form answers, typically name, phone number and email address, plus campaign, ad set, ad and form identifiers.	European Union and United States	Meta's own transfer mechanism under its platform terms.
Google CalendarOnly if enabled	Google Ireland Limited	Reading availability and writing bookings into the connected calendar, where a customer connects one.	Booking time, lead name and contact details, and the appointment note.	European Union and United States	EU Standard Contractual Clauses with the UK Addendum.
CalendlyOnly if enabled	Calendly LLC (United States)	Booking pages and appointment records, where a customer connects Calendly instead of a calendar.	Booking time, invitee name, email address, phone number, and answers to booking questions.	United States	EU Standard Contractual Clauses with the UK Addendum.
Advertising platformsOnly if enabled	Google Ireland Limited, Microsoft Ireland Operations Limited, TikTok Information Technologies UK Limited, and LinkedIn Ireland Unlimited Company	Where a customer connects an advertising account for attribution, we return conversion signals for the leads that platform generated.	Hashed contact identifiers and conversion events for that customer's own leads.	European Union, United Kingdom and United States	Each platform's own transfer mechanism under its advertising terms.
CRM and notification destinationsOnly if enabled	HubSpot Ireland Limited, Salesforce UK Limited, Zoho Corporation B.V., and Slack Technologies Limited	Where a customer connects a CRM or Slack, we push the lead and its status into that system on the customer's instruction.	Lead contact details, a summary of message history, and lead status.	Determined by the customer's own tenancy with that provider	Governed by the customer's own agreement with that provider.

4. What we commit to

Written terms. Every sub-processor is engaged under a written contract imposing data protection obligations no less protective than those we owe our customers.
Due diligence. We assess each provider’s security posture, certifications, breach history and sub-processing before engaging it, and again when its role materially changes.
Transfers. Where processing leaves the United Kingdom we rely on UK adequacy regulations, or on the International Data Transfer Addendum to the EU Standard Contractual Clauses supported by a transfer risk assessment.
Liability. We remain fully liable to our customers for the performance of every sub-processor’s obligations.
Minimisation. Each provider receives only the data its stated purpose requires, and no more.

5. Notice of changes, and your right to object

We give customers at least 30 days’ notice by email before a new sub-processor begins processing their data, and we update this page at the same time.

A customer may object on reasonable data-protection grounds by writing to legal@clientturn.com within the notice period. We will work with you to find an alternative. If we cannot resolve the objection, you may terminate the affected part of the service and receive a pro-rata refund of fees paid for the unexpired part of your subscription term.

Where an existing sub-processor must be replaced urgently — for example because it has suffered a security incident or ceased trading — we may act before the notice period expires, and will tell you what we did and why as soon as we can.

6. Change log

Date	Change
5 September 2026	First publication of the register. Every provider listed above was in place from the start of the service.
27 September 2026	Added Retell AI for the optional AI Voice Sales Agent, and extended Twilio's role to the phone number and call connection for voice. Neither processes call data unless a customer turns voice on.
28 September 2026	Listed Google Places (company discovery for Find Leads, search terms only), which had been in use without appearing here, and corrected Cloudflare R2's description to include support attachments, quote and invoice PDFs and call recordings.

7. Contact

To ask about a provider on this register, to request a copy of a transfer mechanism with commercial terms redacted, or to request a signed data processing agreement, write to legal@clientturn.com.