Annex A

Third-Party Service Providers and Data Recipients

Squarespace

Vendor and owner
Squarespace – Squarespace Ireland Limited / Squarespace, Inc.

Role
Processor for personal data we control through our website; separate controller functions for account/service administration.

Data processed
Website visitor information including IP address, device/browser and usage information; cookie information; contact/enquiry form information; names and email addresses; mailing-list/subscriber information where Squarespace functions are used; course/member information and other content uploaded to the site.

Storage location
Personal data may be processed globally, including by Squarespace, Inc. in the US and other subprocessors.

DPF participation
Yes. Squarespace, Inc. participates in the Swiss-US DPF, EU-US DPF and UK Extension.

Transfer mechanism
Swiss-US DPF where applicable; SCCs or other recognised safeguards where DPF/adequacy does not apply.

DPA
https://www.squarespace.com/dpa

Privacy Policy
https://www.squarespace.com/privacy

Fasthosts

Vendor and owner
Fasthosts Internet Limited.

Role
Processor for hosted customer content where applicable; controller for account, billing and service administration.

Data processed
Domain/account contact information and billing information. Sender and recipient names/email addresses, email content, attachments and email metadata.

Storage location
Fasthosts operates UK hosting infrastructure.

DPF participation
N/A for Fasthosts itself as a UK provider.

Transfer mechanism
UK adequacy where applicable; contractual or other safeguards for onward transfers outside adequate jurisdictions.

DPA
https://static.fasthosts.co.uk/legal/dpa/fasthosts-dpa.pdf

Privacy Policy
https://www.fasthosts.co.uk/terms/policies/privacy-notice

Microsoft

Vendor and owner
Microsoft Ireland Operations Limited / Microsoft Corporation – Outlook, OneNote and, if cloud-synchronised, Word, Excel and PowerPoint.

Role
Processor for qualifying Microsoft 365 customer data; controller for certain account/service data.

Data processed
Names, email addresses, message content, attachments, contacts, calendar information and communication metadata. OneNote: notes and any client information stored/synchronised there. Word/Excel/PowerPoint: document contents where stored or synced through Microsoft cloud services. Desktop-only files are not a separate third-party disclosure.

Storage location
EU and EFTA, including Switzerland.

DPF participation
Yes. Microsoft Corporation participates in the Swiss-US DPF.

Transfer mechanism
EU/EFTA data-boundary arrangements where applicable; Swiss-US DPF and SCCs/other safeguards for relevant transfers.

DPA
https://www.microsoft.com/licensing/docs/view/microsoft-products-and-services-data-protection-addendum-dpa

Privacy Policy
https://www.microsoft.com/en-us/privacy/privacystatement

MailerLite

Vendor and owner
MailerLite Limited, Ireland.

Role
Processor for subscriber/customer-list data.

Data processed
Subscriber name and email address; subscription status; source/sign-up information; custom fields; campaign delivery information; opens, clicks and other engagement data.

Storage location
For customers whose billing address is in Switzerland, MailerLite contracts through MailerLite Limited in Ireland. MailerLite states that subscriber data for EEA, UK and Swiss customers does not leave the EU.

DPF participation
Yes – MailerLite, Inc. participates in the Swiss-US DPF.

Transfer mechanism
EU processing for our subscriber data; SCCs, including applicable Swiss adaptations, where a transfer requiring safeguards occurs.

DPA
https://www.mailerlite.com/legal/data-processing-agreement

Privacy Policy
https://www.mailerlite.com/legal/privacy-policy

Google Workspace

Vendor and owner
Google Ireland Limited (contracting entity) / Google LLC – Google Drive, Google Meet and Google Forms under Google Workspace Business Starter on our business domain.

Role
Processor for Google Workspace customer data under the Google Workspace Cloud Data Processing Addendum; controller for limited account and billing administration.

Data processed
Drive: files and documents we upload or share. Meet: participant/account information, meeting metadata, audio/video and chat. Meeting recording is not available on Business Starter and is not used; course recording is done in Zoom. Forms: form questions and responses, including names and contact details clients submit. No health information is collected through Forms.

Storage location
Google operates global infrastructure and personal data is processed and stored internationally, including in the United States.

DPF participation
Yes. Google LLC participates in the Swiss-US DPF.

Transfer mechanism
Primary reliance on the Swiss-US DPF (Google LLC certified). Standard Contractual Clauses, including applicable Swiss adaptations, are incorporated into the Google Workspace Cloud Data Processing Addendum and operate as the fallback mechanism should DPF adequacy be withdrawn or successfully challenged.

DPA
https://workspace.google.com/terms/dpa_terms.html

Privacy Policy
https://policies.google.com/privacy

Eventfrog

Vendor and owner
Eventfrog AG, Olten, Switzerland.

Role
Independent controller/platform for its ticketing and event services rather than a processor acting solely on our instructions.

Data processed
Ticket purchaser/participant name and contact details; address and telephone number where requested; event/ticket details; payment-method information; IP/log information; and additional event-specific fields selected by the organiser. Participant information is made available to us for event administration.

Storage location
Eventfrog states that core data is hosted on servers in Switzerland. Its privacy materials also identify service providers that may process data outside Switzerland.

Data passes payment data to Datatrans and uses Stripe Payments Europe for payment processing and anti-money-laundering purposes, and it also uses Google Analytics, Google Maps and Google Cloud on the platform.

DPF participation
Eventfrog: N/A as a Swiss provider. Individual subprocessors may participate in applicable DPF frameworks.

Transfer mechanism
Swiss processing for core services; DPF, SCCs or other safeguards for applicable third-country processing by service providers.

DPA
No separate public organiser DPA identified for ordinary ticketing use.

Privacy Policy
https://eventfrog.ch/de/datenschutzerklaerung.html

Wise

Vendor and owner
Applicable Wise group entity / Wise Business.

Role
Independent controller and regulated financial-services provider.

Data processed
Business/account and verification information; representative and beneficial-owner information where applicable; bank/account details; transaction details; amounts, dates and currencies; payer/payee/beneficiary names and account details; device/security information; and compliance/KYC information.

Storage location
Wise operates internationally and permits information to be transferred, stored and processed outside the customer’s country of residence. No Swiss-only storage commitment applies to the ordinary Wise Business relationship.

DPF participation
No Swiss-US DPF reliance identified in the current Wise Business privacy notice.

Transfer mechanism
Adequacy decisions, SCCs and other lawful international-transfer mechanisms, depending on the transfer.

DPA
N/A for the ordinary Wise Business relationship.

Privacy Policy
https://wise.com/gb/legal/privacy-notice-business-en

Stripe

Vendor and owner
Stripe Payments Europe, Limited / Stripe, LLC and Stripe group.

Role
Mixed – Stripe acts as processor for some merchant-directed processing and as controller for payment, fraud, regulatory and service purposes.

Data processed
Customer name, email/contact and billing information; transaction amount, date and product/service information; payment method and payment identifiers; IP/device and fraud/security information; transaction metadata.

Storage location
Stripe operates internationally and does not provide a general Swiss-only residency commitment for standard payment processing.

DPF participation
Yes. Stripe, LLC participates in the Swiss-US DPF.

Transfer mechanism
Swiss-US DPF where applicable; SCCs and other contractual safeguards as fallback/where required.

DPA
https://stripe.com/legal/dpa

Privacy Policy
https://stripe.com/privacy

Calendly

Vendor and owner
Calendly, LLC.

Role
Processor for our controlled scheduling information; separate controller functions for Calendly’s own account/service processing.

Data processed
Invitee name and email address; telephone number if requested; meeting date and time; time zone; calendar/meeting information; responses to scheduling questions configured by us and relevant technical/usage information.

No health-related questions configured. Meeting recording, transcription and AI note-taking disabled.

Storage location
Personal data may be transferred to and stored in the US and other jurisdictions where Calendly and its subprocessors operate.

DPF participation
Yes. Calendly LLC participates in the Swiss-US DPF.

Transfer mechanism
Swiss-US DPF; SCCs with applicable Swiss modifications if the DPF is unavailable or otherwise does not cover the transfer.

DPA
https://calendly.com/legal/data-processing-addendum

Privacy Policy
https://calendly.com/legal/privacy-notice

Vendor and owner
WhatsApp Ireland Limited / WhatsApp LLC – Meta group.

Role
WhatsApp Business app used under a Sally Higham Advisory business profile. Meta remains an independent controller.

Data processed
Participant phone number/account and profile information; group/community membership; messages, photographs, files, voice notes and other information participants choose to share; device, connection and service-usage metadata. Participants join only via a consent-gated invite link after agreeing to group rules; they are not added directly.

Storage location
WhatsApp/Meta operates internationally. Ordinary group use does not provide us with a selectable Swiss-only storage environment.

DPF participation
Yes. WhatsApp LLC participates in the Swiss-US DPF for applicable information received through services offered by WhatsApp Ireland.

Transfer mechanism
Swiss-US DPF and other recognised contractual/international-transfer mechanisms as applicable.

DPA
https://www.whatsapp.com/legal/business-data-processing-terms

Privacy Policy
https://www.whatsapp.com/legal/privacy-policy-eea

Zoom

Vendor and owner
Zoom Communications, Inc.

Role
Processor for customer-controlled meeting content, with separate controller functions for account/service information.

Data processed
Participant/display names and contact information where supplied; meeting metadata; IP/device information; live audio/video/chat/screensharing; and recordings. For our 6-week programme, the intended recording contains our teaching only. Recording is stopped before participant questions and discussion, so participant contributions are not intentionally included in recordings subsequently uploaded to YouTube.

Storage location
Zoom operates global infrastructure.

Local recordings remain on the selected local device; cloud recordings use Zoom’s cloud environment and account/data-routing configuration.

DPF participation
Yes. Zoom participates in the Swiss-US DPF.

Transfer mechanism
Swiss-US DPF; SCCs and other recognised mechanisms for applicable transfers.

DPA
https://www.zoom.com/en/trust/legal-compliance/faq/

Privacy Policy
https://www.zoom.com/en/trust/privacy/privacy-statement/

OpenAI

Vendor and owner
OpenAI Ireland Limited / OpenAI group – ChatGPT Free.

Role
Independent controller under our present consumer account; not our contracted business processor.

Data processed
Generic/public business information only. No client names, participant information, health information or client documents entered or uploaded. Model-training toggle (ChatGPT) and AI data retention (Perplexity) switched off.

Storage location
OpenAI states that information of EEA/Swiss users may be processed and stored outside Switzerland/EEA, including in the US and other countries where OpenAI affiliates and service providers operate.

DPF participation
No Swiss-US DPF certification identified in the current OpenAI European privacy materials reviewed.

Transfer mechanism
Adequacy decisions and SCCs/other appropriate safeguards for relevant international transfers.

DPA
N/A for our ChatGPT Free account. Business DPA:
https://openai.com/policies/data-processing-addendum/

Privacy Policy
https://openai.com/policies/eu-privacy-policy/

Perplexity

Vendor and owner
Perplexity AI, Inc. – Perplexity Free.

Role
Independent controller under our present consumer account; not our contracted business processor.

Storage location
Information may be transferred, stored and processed outside the user’s country, including in the US.

DPF participation
No Swiss-US DPF participation is disclosed in the current notice. Perplexity states participation in the EU-US DPF and UK Extension, but not the Swiss-US DPF.

Transfer mechanism
SCCs and other lawful transfer arrangements. A Swiss transfer should not be presented as relying on the Swiss-US DPF.

DPA
N/A for the Free account. Business DPA:
https://www.perplexity.ai/hub/legal/dpa

Privacy Policy
https://www.perplexity.ai/hub/legal/privacy-notice

YouTube

Vendor and owner
YouTube (Google LLC).

Role
Independent controller/platform. Uploads are made from our own business-controlled Google/YouTube account. All course videos are set to Unlisted.

Data processed
Our YouTube account/channel information; recorded teaching content featuring us; video/audio and upload metadata; and viewer/device/viewing and engagement information when cohort members access the videos. Participants are not intentionally recorded: We will stop the Zoom recording before participant questions or discussion begin.

Storage location
YouTube uses Google’s global infrastructure, including processing in the United States. Data region settings do not apply to YouTube in any edition.