Legal
Sub-processors
The third parties who may handle personal data as part of delivering our services — what each does, where they are, and the basis on which data reaches them.
Last updated 7 September 2026
How this page works
Our Data Processing Agreement relies on this page. By placing an Order you give general written authorisation for the providers listed below, as permitted by Article 28(2) of the UK GDPR.
Before we add or replace any provider on this list, we give you at least 30 days’ written notice. You then have 14 days to object on reasonable data protection grounds. If we cannot resolve an objection, you may terminate the affected service without paying an early termination fee for it.
Keeping this list on a page rather than inside a signed PDF means it stays current without us having to reissue your contract every time a supplier changes.
Why third parties are engaged
Depending on the services you buy and how they are configured, a third party may be engaged either as our sub-processor, or as a processor contracting directly with you. Engagement falls into one of the following categories:
- Managed services
- Supporting infrastructure, monitoring, alert detection and the platforms through which ongoing services are delivered.
- Support services
- Escalation to a software vendor or equipment manufacturer where an issue cannot be resolved by MJM Technology directly.
- Cloud and hosting services
- Infrastructure, software-as-a-service and hosting underpinning the solutions a customer has procured.
- Professional services
- Assistance with implementing or configuring a solution, whether by the vendor itself or a subcontractor engaged by MJM Technology.
Current providers
| Provider | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| NinjaOne Managed services | Remote monitoring and management, device management, ticketing and the end-user support portal. | United States / European Union | UK Addendum to the EU Standard Contractual Clauses |
| Huntress Managed services | Endpoint detection and response, Microsoft 365 identity threat detection, and 24/7 Security Operations Centre monitoring and triage. | United States | UK Addendum to the EU Standard Contractual Clauses |
| Pax8 Cloud and hosting services | Licence provisioning, subscription administration and billing for cloud services procured through MJM Technology. | United Kingdom / United States | UK Addendum to the EU Standard Contractual Clauses |
| Microsoft Cloud and hosting services Direct processor | Microsoft 365 and Azure services. Where these are licensed to the customer, Microsoft processes the customer’s data under the customer’s own agreement with Microsoft. MJM Technology administers the tenant on the customer’s behalf but is not the contracting processor for the underlying platform. | United Kingdom / European Union / United States | Microsoft’s own Data Protection Addendum and transfer terms |
Direct processor means the provider contracts with you rather than with us. We administer the service on your behalf, but the provider’s own data protection terms govern their processing of your data.
Where you buy services beyond those listed here, additional providers may be engaged under the notice process above. Further information on any provider and their data protection credentials is available on request.
Questions about this list, or want to object to a change? Email hello@mjm.technology. Our full terms and policies are on the Legal page.