Legal
( Privacy )
Sub-processors
Draft under legal review. This document is not yet in force. It is published so customers and approval boards can review it, and it may change before it takes effect.
Under our data processing addendum, we engage the sub-processors below to help provide the MAR² platform and products. Each is bound by data protection terms equivalent to ours.
Platform sub-processors
In shortThese apply to every MAR² product.
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Microsoft Azure (Microsoft Corporation) | Cloud hosting: compute, databases, cache, messaging and key management | UK South (London) | Data stored in the UK; Microsoft Products and Services DPA |
| Stripe Payments UK Ltd | Card and direct debit payments for subscriptions | UK, with processing in the US | [safeguard: to be confirmed] |
Product-specific sub-processors
In shortThese apply only if you use the product, and in some cases only if you turn the feature on.
| Product | Sub-processor | Purpose | Location |
|---|---|---|---|
| Ledger | Twilio SendGrid | Sending invoices and statements by email, when email sending is enabled | United States (UK IDTA) |
| Ledger | TrueLayer Ltd | Bank feeds through Open Banking. TrueLayer is an FCA-authorised account information service provider and acts under its own terms, which you accept when connecting | United Kingdom |
| Ledger | Staffology (IRIS Software Group) | Importing finalised pay runs, when the payroll connection is enabled | United Kingdom |
| Capture | [AI provider: to be confirmed] | Reading text and fields from uploaded documents, when AI extraction is enabled | [location: to be confirmed] |
| Estate | Amazon Web Services EMEA SARL | Cloud hosting for Estate | UK, London (eu-west-2) |
Recipients that are not sub-processors
- When you ask a product to file or submit information to a public body, such as HM Revenue & Customs or Companies House, we send it as your agent. Those bodies are independent controllers, not our sub-processors.
Changes and notifications
- We give at least 30 days’ notice before a new sub-processor starts processing customer personal data. To be notified, email privacy@marsquared.com with the subject “Sub-processor updates”. Objections are handled as set out in the data processing addendum.
Change log
| Version | Date | Change |
|---|---|---|
| 0.9 | 30 October 2026 | First list. Items marked to be confirmed are checked before go-live. |