Third Party Sub Processors
Last updated: October 2026
This page lists the sub-processors we use to deliver ExpensePlus, which means third parties that process personal data on your behalf. It forms part of our Data Processing Agreement https://expenseplus.co.uk/legal/dpa.
You give us general authorisation to use these sub-processors. We have a written contract with each one that includes data protection obligations no less protective than those in our Data Processing Agreement.
Definitions We Use In This Document
"The Service" means our ExpensePlus software, which is accessed online through a web browser. Access is provided through a unique username/password. The service also includes any files you upload to ExpensePlus.
"you", "your", "your Organisation" means the church, charity or other type of organisation that has opened an ExpensePlus account. In relation to the personal data that you or your users enter into The Service, your Organisation is the Data Controller, as defined in the UK GDPR.
"us", "we" and "our" refer to ExpensePlus Ltd. In relation to the personal data that you or your users enter into The Service, ExpensePlus Ltd is the Data Processor, as defined in the UK GDPR. For personal data that we use for our own purposes, such as account contact details, billing, marketing and analysis of how The Service is used, ExpensePlus Ltd is a Data Controller, as described in our Privacy Policy.
"your users" means the individuals within your Organisation to whom access to The Service has been granted, including the person who signs up on your behalf.
"UK GDPR" means the UK General Data Protection Regulation, as defined in the Data Protection Act 2018, as amended or replaced from time to time.
"Data Processing Agreement" means our data processing agreement, which forms part of these Terms of Service.
Sub-processors We Currently Use
| Sub-processor | What it does | When it is used | Location | Transfer mechanism |
|---|---|---|---|---|
| Linode Akamai | Hosts ExpensePlus | All customers | UK | Not applicable (UK) |
| Amazon Web Services (AWS) | Hosts backups of ExpensePlus | All customers | UK | Not applicable (UK) |
| Google (Gmail) | Sends outbound emails | All customers | United States | UK Addendum to the EU SCCs |
| HelpScout | Manages support requests | When you contact support | United States | UK Extension to the EU-US DPF (fallback: UK Addendum) |
| Stripe | Processes card payments | Only if you enable card payments from your own payers | United States | UK Extension to the EU-US DPF (fallback: UK Addendum) |
Changes to this list
We will give you at least 30 days’ notice before we add or replace a sub-processor. We will update this page and email your account contact. If you object on reasonable data protection grounds, please write to dpo-contact@expenseplus.co.uk within that 30-day period. We will work with you to resolve it. If we cannot, you may cancel your subscription at any time before the change takes effect, without penalty. This means we will not charge any cancellation fee, or any further subscription fees after you cancel. Access to the Service ends when you cancel, and we will not refund fees you have already paid. You can therefore choose to cancel as late as the day before the change takes effect.
Connected third-party services
If you connect a third-party service to The Service (for example Open Banking feeds, SumUp or HMRC for Gift Aid), you instruct us to exchange data with that service on your behalf. These services are not our Sub-processors. They act under their own terms with you, and you are responsible for your agreements with them and for telling data subjects about the sharing. We are not responsible for how they handle data once it leaves, or before it reaches, The Service.
Our own operations
We also use other tools for our own business purposes, such as billing, our newsletter and internal communication. Those are described in our Privacy Policy.