Last updated: 29 October 2026
When we provide IT support to a school, the school is the data controller and Drift IT Limited is a data processor. Our data processing agreement with each school allows us to use the sub-processors on this page. This is the current, authoritative list referred to in clause 4 of that agreement.
Before we engage a new sub-processor, we update this list and notify the schools we support, giving them at least 14 days to object on reasonable data protection grounds. Removing a sub-processor, or replacing one with a supplier providing an equivalent service on materially similar terms, is also recorded here.
Microsoft 365 and Google Workspace
Where we are a school’s Cloud Solution Provider (CSP) reseller for Microsoft 365, Microsoft is our sub-processor for that school’s tenant. We resell through Westcoast Cloud and Giacom, Microsoft indirect CSP distributors, who each hold their own delegated administrative access into the tenants they distribute for, so they are also our sub-processors.
Where a school has its own direct Microsoft agreement and has given us delegated administrative access (for example through GDAP) without us reselling the licence, Microsoft processes the school’s data under the school’s own agreement, and none of Microsoft, Westcoast Cloud or Giacom is our sub-processor for that tenant.
The same applies to Google Workspace: where we resell a school’s Google Workspace licence through Simply Techspace, Google and Simply Techspace are our sub-processors for that tenant; where the school has its own direct agreement with Google, they are not. We’ll confirm which applies to your school on request.
Current sub-processors
| Sub-processor | Purpose | Location and transfer safeguard |
|---|---|---|
| Microsoft 365 (our own tenant) | Email and productivity used by our own staff | UK/EU data residency (confirmed); transfer safeguards built into Microsoft’s own customer terms |
| Microsoft 365 (school tenants, where we are the CSP reseller) | Licensing and administration of the school’s Microsoft 365 tenant, where we resell the licence | UK/EU data residency (confirmed); transfer safeguards built into Microsoft’s own customer terms |
| Google Workspace (our own tenant) | Email and productivity used by our own staff | UK/EU data residency (confirmed); transfer safeguards built into Google’s own customer terms |
| Google Workspace (school tenants, where we are the reseller) | Licensing and administration of the school’s Google Workspace tenant, where we resell the licence | UK/EU data residency (confirmed); transfer safeguards built into Google’s own customer terms |
| Westcoast Cloud | Microsoft indirect CSP distributor; holds delegated administrative access into school tenants licensed through our CSP reseller arrangement | United Kingdom; no restricted transfer |
| Giacom | Microsoft indirect CSP distributor; holds delegated administrative access into school tenants licensed through our CSP reseller arrangement | United Kingdom; no restricted transfer |
| Simply Techspace | Google Workspace indirect reseller distributor; holds delegated administrative access into school tenants licensed through our reseller arrangement | United Kingdom; no restricted transfer |
| Ubiquiti (UniFi Site Manager) | Network management | United States; covered by the UK Extension to the EU-US Data Privacy Framework (certification to be periodically reconfirmed) |
| NinjaOne | Remote monitoring and management (RMM) | United States; UK/EU transfer safeguard (SCC module) executed with vendor |
| Freshdesk (Freshworks) | Helpdesk ticketing | United States; covered by the UK Extension to the EU-US Data Privacy Framework |
| HaloPSA | Helpdesk ticketing, service management and billing | United Kingdom; no restricted transfer |
| Redstor | Backup | United Kingdom; no restricted transfer |
| ZigaFlow | Workflow and operations platform | United Kingdom; no restricted transfer |
| Aruba (HPE Aruba Networking Central) | Networking | United States parent (HPE); account region confirmed as EU; no restricted transfer |
| 2Teck | Data cabling installation; given site contact details and site maps to arrange access, with no access to school or Drift systems | United Kingdom; no restricted transfer; confidentiality and data-handling terms confirmed with vendor |
| Hugh Symons AV | AV equipment supply; given a site contact name and address for direct delivery, with no access to school or Drift systems | United Kingdom; no restricted transfer; confidentiality and data-handling terms confirmed with vendor |
| Loxit | Device storage and charging equipment supply; given a site contact name and address for direct delivery, with no access to school or Drift systems | United Kingdom; no restricted transfer; confidentiality and data-handling terms confirmed with vendor |
| Zioxi | Device storage and charging equipment supply; given a site contact name and address for direct delivery, with no access to school or Drift systems | United Kingdom; no restricted transfer; confidentiality and data-handling terms confirmed with vendor |
| LapCabby | Device storage and charging equipment supply; given a site contact name and address for direct delivery, with no access to school or Drift systems | United Kingdom; no restricted transfer; confidentiality and data-handling terms confirmed with vendor |
| ClassLink | Single sign-on and class rostering; licensed and administered by us on the school’s behalf | United States; transfer safeguard confirmed with vendor |
| InVentry | Visitor and staff sign-in and safeguarding attendance records; licensed and administered by us on the school’s behalf | United Kingdom; no restricted transfer |
| Lightspeed Systems (MDM) | Mobile device management; licensed and administered by us on the school’s behalf | United States; covered by the UK Extension to the EU-US Data Privacy Framework (certification to be periodically reconfirmed) |
| NetSupport | Classroom management and remote support software; licensed and administered by us on the school’s behalf | United Kingdom; no restricted transfer |
| Talk Straight (Schools Broadband) | Internet connectivity and telecoms; licensed and administered by us on the school’s behalf | United Kingdom; no restricted transfer |
| Smoothwall (Qoria) | Web filtering and safeguarding monitoring; licensed and administered by us on the school’s behalf | UK entity, part of an Australian-headquartered group; data centre region and transfer safeguard confirmed with vendor |
| Medhurst Communications Limited | Our parent company; holds a contractual right to request access to our systems for governance and oversight purposes (see clause 11 of our data processing agreement) | United Kingdom; no restricted transfer |
Questions
If you have any questions about how we handle personal data, or would like a copy of our data processing agreement, please email us or call 02392 475062. See also our privacy notice.