NurtureHub Sub-Processor Inventory: UK GDPR Article 28 Compliance
NurtureHub Sub-Processor Inventory: UK GDPR Article 28 Compliance
Published: 2025
Release: v1.0.89
Compliance Area: UK GDPR Article 28 — Third-Party Data Processor Obligations
Overview
NurtureHub processes personal data about UK property contacts on behalf of agent customers. In this relationship:
- Agent customers are the data controllers — they decide why personal data is collected and how it is used.
- NurtureHub is the data processor — it processes personal data under documented instructions from those controllers.
- Third-party services that NurtureHub routes personal data through are sub-processors.
Under UK GDPR Article 28, data controllers must:
- Be informed of which sub-processors are engaged.
- Approve sub-processor appointments (or have a mechanism to object).
- Ensure sub-processors are contractually bound to appropriate data protection obligations.
To meet these obligations, NurtureHub has published a Sub-Processor Register at /legal/sub-processors.
What Is a Sub-Processor?
A sub-processor is any third-party organisation that NurtureHub instructs to process personal data on behalf of an agent customer. This includes services used for email delivery, AI inference, database hosting, CRM synchronisation, communications, advertising integrations, and background job execution.
Current Sub-Processor Register
The following third-party services receive personal data as part of NurtureHub's operation. Full details — including data location, purpose, and applicable data processing agreements — are maintained on the public register page.
Email & Communications
| Service | Role | Data Processed |
|---|---|---|
| Resend | Transactional and marketing email delivery | Recipient name, email address, email engagement metadata |
| Twilio | SMS and voice communications | Recipient name, phone number, message content |
AI Services
| Service | Role | Data Processed |
|---|---|---|
| OpenAI | AI-generated email content and lead scoring | Contact context data used to generate personalised sequences |
Advertising Integrations
| Service | Role | Data Processed |
|---|---|---|
| Meta Ads | Audience matching and ad attribution | Hashed contact identifiers (email / phone) |
| Google Ads | Audience matching and ad attribution | Hashed contact identifiers (email / phone) |
Data Enrichment
| Service | Role | Data Processed |
|---|---|---|
| Apify | Web data extraction for contact enrichment | Publicly available property and contact data |
CRM Integrations
| Service | Role | Data Processed |
|---|---|---|
| agentOS | Bidirectional CRM sync | Contact records, property data, tenancy data |
| Reapit | Bidirectional CRM sync | Contact records, property data, tenancy data |
| Alto | Bidirectional CRM sync | Contact records, property data, tenancy data |
| Loop | Bidirectional CRM sync | Contact records, property data, tenancy data |
| Street | Bidirectional CRM sync | Contact records, property data, tenancy data |
Infrastructure
| Service | Role | Data Processed |
|---|---|---|
| Neon | Managed PostgreSQL database | All structured application data |
| Inngest | Background job orchestration | Job payloads including contact data |
| AWS / Tigris | Cloud infrastructure and object storage | Application data, file uploads, backups |
Where to Find the Full Register
The canonical, always-current register is published at:
https://nurturehub.app/legal/sub-processors
This page is publicly accessible without login and is referenced from the NurtureHub Privacy Policy.
Notification of Changes
When NurtureHub appoints a new sub-processor or removes an existing one, the register will be updated and agent customers notified in accordance with the terms of the Data Processing Agreement (DPA). Customers who require prior notification before a new sub-processor is engaged should refer to the DPA for the applicable process.
Questions
For data protection enquiries, contact: privacy@nurturehub.app
For questions about a specific CRM integration and the data shared, refer to the individual integration documentation or contact support.