SUBPROCESSOR SCHEDULE TEMPLATE

Production suppliers and processing locations

This schedule is deliberately incomplete. It is a versioned structure for disclosing the suppliers that will process customer personal data, not a statement that no suppliers are used.

Template version 2026-07-30-template-1

Do not use this schedule for production onboarding yet. The operator must inspect the deployed hosting, database, payment, email, monitoring, support, backup and mobile services and publish the contracted legal entity, purpose, data, location and transfer safeguard for every subprocessor before live processing.

Current publication status

Supplier legal entity	Service and data	Processing locations	Transfer safeguard	Status
To be completed	To be completed from production contracts and data flows	To be completed	To be completed where required	Not approved for production publication

Minimum information for each entry

The supplier’s contracted legal entity and a link to relevant privacy or security information.
The service function, personal-data categories and affected data subjects.
Primary processing and support-access countries, including backup locations where relevant.
The UK transfer mechanism and transfer-risk assessment where adequacy does not apply.
The appointment date, material changes and the date the entry was last verified.

Changes and objections

The completed Data Processing Agreement must state whether authorisation is specific or general. Under general authorisation, it must define how customers receive advance notice of an intended addition or replacement, the reasonable objection route and what happens if an objection cannot be resolved. This template does not invent a notice period.

How to complete this schedule

Create and approve an actual production data-flow and supplier inventory.
Match every external recipient with its contract, role, locations, retention and security evidence.
Complete international-transfer assessments and safeguards where required.
Have the operator and a qualified adviser review the schedule and DPA together.
Set the production-readiness configuration only after the published entries match the deployed services.

Questions or requests for the completed schedule can be sent to info@optimustech.co.uk. Until the schedule is completed, that contact route is not a substitute for the missing disclosures.