Version 1.0 · Last updated: 2 November 2026
You are the controller of the referral and staff information you put into Elyndra, and we are your processor. To run the service we use a small number of other companies (our “sub-processors”). This page lists each one, what information it receives, where that information is held, and how long it is kept.
We will tell you at least 30 days before we add or replace a sub-processor that handles your data, so that you have time to raise an objection with us. This is the notice period set out in our data processing agreement with you.
The current version of this page is always at www.elyndra.co.uk/subprocessors. It is published by Empower Aid Technologies Ltd (“Elyndra”) for attachment to our data processing agreement.
Where your data is
Stored in the UK. All of your data is stored in Microsoft’s UK South data centre (London). Copies of your documents and of our server backups are also kept in Microsoft’s UK West data centre (Cardiff). Backups of the database are kept in London only.
Read by the AI in the EU. The AI that reads referrals runs on Microsoft’s Azure OpenAI service and is processed only within the European Union. It does not send data to OpenAI, your data is never used to train AI models, and no copy of it is kept after a referral has been read.
Error reports in the EU. Technical error reports are held in Germany.
Support requests go to the United States. When your team sends us a support request from inside Elyndra, it reaches our support team through Slack, which stores it in the United States under contract terms approved for sending information out of the UK. This is the only part of the service that sends anything outside the UK or the EU, which is why we ask you not to put a child’s details in a support request.
Pop-up notifications go through the browser’s own service. If a member of your staff turns on notifications, their browser’s maker delivers them. The notification is scrambled so that only their device can read it, and we keep children’s names out of the wording in any case.
Our sub-processors
Microsoft (Azure)
What it does for us: Hosts the service: servers, database, document storage, backups
What it receives: All of the information in the service, including referrals and their documents
Where: UK (London; copies of documents and server backups in Cardiff)
How long it is kept: Until it is removed under your retention settings or you delete it. Deleted information stays in our backups for up to 35 days, then is gone.
Its data protection terms: Microsoft DPA
Microsoft (Azure OpenAI)
What it does for us: The AI that reads referral emails and documents, pulls out the key details, and suggests tags
What it receives: The text of referral emails and documents, which includes children’s personal and sensitive information
Where: European Union
How long it is kept: We do not store any of it, and neither does Microsoft. Microsoft normally keeps a copy of some text so its staff can check the service is not being misused — we have been granted an exemption from that, so no copy is kept and no Microsoft employee ever reads your referrals. An automatic check still runs as each referral is read, but it keeps nothing. The text is never used to train AI models.
Its data protection terms: Microsoft DPA
Microsoft (Azure Communication Services)
What it does for us: Sends emails from the service, such as notifications and sign-in codes
What it receives: Your staff’s email addresses and the content of those emails
Where: UK
How long it is kept: Delivery records only, under Microsoft’s terms
Its data protection terms: Microsoft DPA
Okta (Auth0)
What it does for us: Signs your staff in
What it receives: Staff names, work email addresses and sign-in records. No referral or child information.
Where: UK
How long it is kept: Account details for as long as the staff member has an account. Records of individual sign-ins are kept for a few days only.
Its data protection terms: Okta DPA
Sentry
What it does for us: Tells us when something goes wrong in the service
What it receives: Technical error reports. We remove children’s details from these, but a small amount of personal information can occasionally be included.
Where: EU (Germany)
How long it is kept: Error reports for 90 days, technical logs for 30 days
Its data protection terms: Sentry DPA
Slack
What it does for us: Passes support requests you send us from inside the service to our support team
What it receives: Your name, work email and the message you write. We ask you not to include children’s details, and the form says so.
Where: United States
How long it is kept: Until we delete it
Its data protection terms: Slack DPA
Google, Mozilla or Apple (whichever made your staff member’s web browser)
What it does for us: Delivers pop-up notifications to a device, when a staff member has turned them on
What it receives: The delivery address for that device, and the time a notification is sent. They cannot read the notification — it is scrambled so that only the device can open it.
Where: Set by the browser’s maker
How long it is kept: An undelivered notification is held for at most 12 hours, then dropped
Its data protection terms: None — see “Contracts” below
Paying by Direct Debit
If you pay by Direct Debit, you set that up with GoCardless yourself and give them your billing contact and bank details directly. GoCardless is responsible for that information in its own right, under its own agreement with you, so it is not one of our sub-processors. We only send it a reference number so we can show your billing details back to you inside Elyndra. It never receives any referral or child information.
Your own email inbox
If you connect your team’s email inbox (Microsoft 365 or Google), Elyndra reads referral emails from it and can save draft replies into it, with your permission. That inbox stays in your own Microsoft or Google account and is covered by your own agreement with them, so they are not our sub-processor.
Support access by Elyndra staff
When we investigate a problem, a small number of named Elyndra engineers can view your data, read-only. They may use an AI assistant (Anthropic’s Claude, run on Amazon Web Services in the EU) to help. Amazon does not keep the information or use it for training, and these sessions are recorded against the individual engineer.
The same assistant also helps us prepare fixes for faults the system reports. It reads our own software and the description of the fault, which can quote an error message, and an error message can occasionally include a line of your information. That runs on Amazon Web Services in the EU as well, and an Elyndra engineer reviews and approves every change before it goes anywhere near the live service.
Amazon Web Services
What it receives: Only the information an engineer looks at while fixing a problem
Where: European Union
How long it is kept: Not kept
Its data protection terms: AWS DPA and UK Addendum
How long we keep referral information
You choose how long referral details are kept, between 7 and 365 days after a referral arrives. If you have not chosen, we remove them after 180 days. After that, the child’s details, the case summary and the original email and documents are removed automatically. Referrals you placed are kept. Copies of the AI’s working are removed at the same time, and in any case after 180 days.
Referrals nobody is working on. Your settings also control whether details are removed when nobody on your team has opened or updated a referral for a while. Where this is switched on, we remove them after 21 days unless you choose otherwise, and you can set anything from 7 to 90 days. Your settings page shows whether it is on for your organisation.
Referrals you decline. You can also choose to have a declined referral’s details removed sooner, rather than waiting for the date above. This is switched off unless you ask us for it. When it is switched on, we remove the details a set number of days after your team records the decline — 30 days unless you choose otherwise, and you can set anything from straight away up to 90 days.
Contracts
Each sub-processor is bound by a data processing agreement that meets UK GDPR Article 28:
Microsoft: Microsoft Products and Services Data Protection Addendum
Okta (Auth0): Okta Data Processing Addendum
Sentry: Sentry Data Processing Addendum
Amazon Web Services: AWS GDPR Data Processing Addendum, with its UK GDPR Addendum
These links go to each company’s current published terms. We also keep our own dated copy of each one, so if you need to see the version that applied when you signed with us, rather than the version published today, ask and we will send it.
The one exception is the browser notification services above. We have no contract with them, and we do not choose them: the staff member’s own browser picks the service and creates the delivery address when they turn notifications on. They receive no readable information from us, and a staff member can switch notifications off at any time.
What has changed
Version 1.0, 2 November 2026: First published version.
We update this page whenever we add or replace a company that handles your information, when one of them changes the country it holds it in or the information it receives, and when we correct a figure or a description. For an addition or a replacement we will tell you at least 30 days beforehand, so that you have time to raise an objection with us.
Being told about changes
We send each notice by email to the person your organisation has named as its privacy contact. To name someone, or change who it is, email privacy@elyndra.co.uk with their name and email address.
Questions
Email privacy@elyndra.co.uk, or contact your Elyndra account manager.
This page is copied from the version kept in Elyndra’s own records, and both carry the same version number. If you need the version that applied on a particular date, rather than the one published today, ask us and we will send it.
