Legal
Sub-processors
The third parties who may handle personal data as part of delivering our services — what each does, where they are, and the basis on which data reaches them.
Last updated 7 October 2026
How this page works
Our Data Processing Agreement relies on this page. By placing an Order you give general written authorisation for the providers listed below, as permitted by Article 28(2) of the UK GDPR.
Before we add or replace any provider on this list, we give you at least 30 days’ written notice. You then have 14 days to object on reasonable data protection grounds. If we cannot resolve an objection, you may terminate the affected service without paying an early termination charge for it.
Keeping this list on a page rather than inside a signed PDF means it stays current without us having to reissue your contract every time a supplier changes.
Why third parties are engaged
Depending on the services you buy and how they are configured, a third party may be engaged either as our sub-processor, or as a processor contracting directly with you. Engagement falls into one of the following categories:
- Managed services
- Supporting infrastructure, monitoring, alert detection and the platforms through which ongoing services are delivered.
- Support services
- Escalation to a software vendor or equipment manufacturer where an issue cannot be resolved by MJM Technology directly.
- Cloud and hosting services
- Infrastructure, software-as-a-service and hosting underpinning the solutions a customer has procured.
- Professional services
- Assistance with implementing or configuring a solution, whether by the vendor itself or a subcontractor engaged by MJM Technology.
Current providers
| Provider | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| NinjaOne Managed services | Remote monitoring and management, device management, ticketing, the end-user support portal, and backup where the Order includes it. | United States / European Union | UK Addendum to the EU Standard Contractual Clauses |
| Huntress Managed services | Endpoint detection and response, with 24/7 Security Operations Centre monitoring and triage of endpoint detections. | United States | UK Addendum to the EU Standard Contractual Clauses |
| Petra Security Managed services From 7 November 2026 | Identity threat detection and response for Microsoft 365: continuous analysis of sign-in and activity logs to detect account compromise, and 24/7 containment by its Security Operations Centre — revoking sessions, blocking sign-in, and removing malicious inbox rules, applications and messages. | United States | UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, in place before any customer data is transferred |
| Pax8 Cloud and hosting services | Licence provisioning, subscription administration and billing for cloud services procured through MJM Technology. | United Kingdom / United States | UK Addendum to the EU Standard Contractual Clauses |
| Microsoft Cloud and hosting services Direct processor | Microsoft 365 and Azure services. Where these are licensed to the customer, Microsoft processes the customer’s data under the customer’s own agreement with Microsoft. MJM Technology administers the tenant on the customer’s behalf but is not the contracting processor for the underlying platform. | United Kingdom / European Union / United States | Microsoft’s own Data Protection Addendum and transfer terms |
Direct processor means the provider contracts with you rather than with us. We administer the service on your behalf, but the provider’s own data protection terms govern their processing of your data.
Where you buy services beyond those listed here, additional providers may be engaged under the notice process above. Further information on any provider and their data protection credentials is available on request.
Questions about this list, or want to object to a change? Email hello@mjm.technology. Our full terms and policies are on the Legal page.