Subprocessors

Effective Date: 11th February 2026

Last Modified: 11th February 2026

1. Overview

Longbow Insurance Technology uses third-party service providers (“subprocessors”) to help deliver the Platform. Where these subprocessors process personal data on our behalf, they do so under strict data processing agreements that require them to implement appropriate technical and organisational security measures and process data only in accordance with our instructions.

This page lists the categories and names of subprocessors currently engaged by Longbow. It is maintained in accordance with our obligations under Article 28 of the UK GDPR and the terms of our Data Processing Agreements with broker customers.

2. Notification of Changes

We will update this page when subprocessors are added or removed. Where our Data Processing Agreement with a broker customer includes subprocessor change notification provisions, we will notify the customer in accordance with those terms, providing reasonable advance notice and the opportunity to object before any new subprocessor begins processing personal data.

3. Current Subprocessors

•  Cloud Infrastructure & Hosting

Subprocessor: AWS
Geographic Location: Global
Role: Cloud Hosting
Data Transfer Mechanism: SCCs, DPA:

Subprocessor: Microsoft
Geographic Location: Global
Role: Email and Infrastructure (Outlook, Office365)
Data Transfer Mechanism: SCCs

•  Communication & Email Services

Subprocessor: Apollo
Geographic Location: US
Role: Automated email/workflows
Data Transfer Mechanism: SCCs

Subprocessor: Postmark
Geographic Location: US
Role: Transactional emails
Data Transfer Mechanism: SCCs

•  Product Analytics & User Behaviour Tracking

Subprocessor: Hotjar
Geographic Location: EU
Role: UX tracking, heatmaps
Data Transfer Mechanism: SCCs

Subprocessor: Mixpanel
Geographic Location: US
Role: Product analytics
Data Transfer Mechanism: SCCs

Subprocessor: Pusher
Geographic Location: UK/EU
Role: Real-time data updates
Data Transfer Mechanism: SCCs

•  Form & Web Tools

Subprocessor: Webflow
Geographic Location: US
Role: Website hosting
Data Transfer Mechanism: SCCs

•  AI & Language Model Tools‍

Processing is based on Rehuman’s legitimate interests in maintaining platform functionality and internal efficiency (UK/EU GDPR Art. 6(1)(f)). No customer-specific decision-making or profiling is carried out using AI systems.

Subprocessor: Anthropic
Geographic Location: US
Role: Natural Language Processing
Data Transfer Mechanism: SCCs, API Terms

Note: Rehuman uses Anthropic APIs for internal automation tasks (e.g., summarization, general AI capabilities). No identifiable personal or customer data is shared with Anthropic. All prompts are anonymised or synthetic. Rehuman does not use Anthropic for outbound customer communication, profiling, or policy decision-making.

•  Support & Services

Subprocessor: Office 365
Geographic Location: US
Role: Support Communications (email, docs)
Data Transfer Mechanism: SCCs

•  Data Transfer Safeguards & Notification

All international transfers of personal data are governed by the use of Standard Contractual Clauses (SCCs) or similar safeguards. We assess subprocessor risk prior to engagement and notify customers of material changes to this list via email or dashboard notifications at least 30 days in advance.

•  Processors’ Subprocessors

Some subprocessors listed above may use their own subprocessors (e.g., cloud infrastructure, logging services), which are contractually bound to equivalent security and privacy obligations via back-to-back DPAs.

•  Other Tools & Services (Non-Core / Contextual Use Only)

Longbow may use additional third-party tools on an ad hoc or non-production basis (e.g., recruitment platforms, event registration, beta-testing environments). These are isolated from core user data and subject to internal approval before use.

4. Questions

If you have questions about our subprocessors or wish to receive notification of changes, please contact info@longbowtech.co.uk.