United Kingdom
Ireland
In order to provide the services that we offer as efficiently as possible, Open GI (and associated companies) may use third parties to perform certain functions and in doing so, they may process customer data or personal data as part of the service. In some circumstances, the third party may have been appointed by Open GI’s client to act as their processor or the third party may be a data controller itself, but in other circumstances the third party may be acting directly as a sub-processor of Open GI under Open GI’s general written agreement to appoint sub-processors to process client data on the data controller’s behalf.
This list separates the following entities which we have defined in this notice:
Sub-Processori: This is a data protection term under GDPR Article 28(4) and will apply to entities (including some applicable sub-contractors) where Open GI has engaged them under the client’s general authorisation to carry out part of the processing Open GI performs on the client’s behalf. They will process client data only within the purposes the client has determined and on the client’s instructions, passed down through Open GI, and never for any purpose of its own. Open GI’s selection determines the technical means of implementation only. The client determines the purposes and essential means of the processing. Open GI does not determine its own purposes for the data processing. Where required under the applicable agreement, Open GI will provide notice of intended changes to its sub-processors and explain how clients may submit an objection where applicable.
Some of our sub-processors may use further sub-processors in providing their services. Information about the applicable processing chain will be made available by Open GI on request.
Authorised ‘Recipient’ii: The client has engaged the recipient directly or has a business relationship with it to perform part of a processing function; for example, an insurer. Open GI is a peer in the chain, not its principal, and we facilitate processing functions such as enrichments, lookups, fraud checks, etc. The recipient’s role depends on the relevant service and contractual arrangement. A recipient is defined in the UK and EU GDPR (see footnote ii).
Open GI retains responsibility for the processing it carries out on behalf of its clients and requires its sub-processors to process personal data only on documented instructions, subject to appropriate contractual, security and oversight controls. Personal data is limited to the minimum required to provide the relevant service.
Sub-processors engaged by Open GI to process client data on behalf of its clients
| Third party | Purpose | Applicable services | Location of Hosting or Processing |
|---|---|---|---|
| Associated Open GI group companies (Machine Learning Programs [MLP Newco 1 Limited], Transactor Global Solutions Limited, Powerplace Insurance Services Limited, Open GI London Limited, Open GI Ireland Limited) | Processing of client data for the delivery of the contracted services. | Various, including Core, IHP, Ratings, Powerplace, Propensity machine learning models, Mobius, V6, V7 | UK / EU (Ireland / Poland) (Processing) |
| Associated Group Company Open GI Group LLC Skopje | Software development customer support which can entail processing of client data for support tickets. This processing is performed under the responsibility of Open GI UK. | Mobius | Skopje, North Macedonia (Processing) Appropriate standard contractual clauses, transfer risk assessment, DPIA, and employee authorisations are in place and documented. |
| Associated Group Company Transactor Poland sp.z.o.o | Software development customer support which can entail processing of client data for support tickets. This processing is performed under the responsibility of Open GI UK. | Mobius | Krakow, Poland (Processing) |
| Microsoft Limited (UK) | Provision of Microsoft Azure cloud infrastructure, including storage, networking and compute services. Microsoft processes personal data in accordance with the applicable contractual terms and Open GI’s documented instructions. Access is restricted in accordance with Microsoft’s technical and organisational controls. | Mobius, Self-service Online Portal | UK (Hosting and Processing) |
| Microsoft Ireland Operations Limited | Provision of Microsoft Azure cloud infrastructure, including storage, networking and compute services. Microsoft processes personal data in accordance with the applicable contractual terms and Open GI’s documented instructions. Access is restricted in accordance with Microsoft’s technical and organisational controls. | Ratings, IHP | Dublin, Ireland (Hosting and Processing) |
| Telehouse International Corporation of Europe Ltd | Provision of ‘rack’ hosting only (co-location). All compute, storage, and networking are owned and maintained by Open GI. Telehouse has no general access to our systems, data, or our hardware. However, in certain cases where priority support is required, such as replacement of a failed hard drive in an array where our own employees are unable to attend in time, we do have a “remote hands” agreement with this provider. | Core Cloud, eBroker / Digital Elements, Powerplace, GiHub, Corporate Websites, Customer Support Site, V6/V7 | UK (Hosting and Processing) |
| OVH Limited | Hosting of MLP Machine Learning services | MLP Propensity to Claim, MLP Score | OVH UK (Hosting and Processing) |
| MongoDB, Inc. (Incl. Mongo Atlas) | Cloud database storage | IHP, Ratings, Mobius | Dublin, Ireland (Hosting and Processing) |
| COEO Limited | Database managed support | SQL support | UK (Processing) |
| Next Venture Trading Limited | Bridge between eAggregator and Transactor TES agg / Mobius | V6/V7, Mobius | UK (Hosting and Processing) |
| ThoughtSpot EMEA Limited | Data and Analytics visualisation (charting metrics, etc.) | Data and Analytics Platform | UK (Processing) |
| Deloitte LLP | Consultancy work to assist or advise Open GI on platform client migrations and other technology related work. Some access to client data may be needed. | Core, V6/V7, Mobius, IHP, Ratings | UK (Processing) |
| Deloitte (Romania) | Consultancy work to assist or advise Open GI on platform client migrations and other technology related work. Some access to client data may be needed. | Core, V6/V7, Mobius, IHP, Ratings | Romania (Processing) |
| Deloitte (Hungary) | Consultancy work to assist or advise Open GI on platform client migrations and other technology related work. Some access to client data may be needed. | Core, V6/V7, Mobius, IHP, Ratings | Hungary (Processing) |
Authorised Recipients – Other partners we work with, but who are not processing client data solely via an engagement from Open GI on behalf of the data controller.
These may be data controllers in their own right or processors under instruction from a data controller (please refer to each entity’s privacy notice). Open GI may provide the platform or conduit to connect the entity such as a broker or insurer to the other party. For example, facilitating the connection of a broker to a credit reference agency.
| Third party | Purpose | Applicable services |
|---|---|---|
| Motor Insurers’ Bureau (My Licence) | Enrichment & checking services (UK) | Core, Mobius, Ratings, IHP, V6/V7 |
| Royal Mail Group Limited | Address Lookup Services (UK) | Core, V6/V7, Mobius |
| Close Brothers Limited | Premium Finance (UK) | Core, V6/V7, Mobius |
| Towers Watson Limited (WTW Radar / Radar) | Enrichment & checking services | IHP, Ratings |
| Premium Credit Limited | Premium Finance | Core, V6/V7, Mobius |
| Bizmaps Limited (Autoaddress Gamma/ Bizmaps) | Enrichment & checking services | Core, IHP, Ratings |
| Auto Records Limited (Cartell) | Lookups | Core (ROI) |
| Carweb Limited | Vehicle Lookups | Core, V6/V7, Mobius |
| Accadian | Enrichment & screening services | Core, IHP, Ratings |
| Creation Consumer Finance Limited (BNP Paribas) | Premium Finance | Core, V6/V7 |
| Eagle Eye Solutions Limited | Outgoing SMS Service | Core, V6/V7, Mobius (UK) |
| Equifax Limited | Enrichment & screening services | Core, IHP, Ratings, V6/V7 |
| Experian Limited | Enrichment & screening services | Core, V6/7, IHP, Ratings |
| Flood Re Limited | Enrichment & checking services (UK) | IHP, Ratings, V6/V7 |
| Global Payments U.K. Ltd. | Provision of vendor hosted payment iFrames or hosted redirects that Open GI embeds within its applicable solutions | Core, Mobius, V6 (UK) |
| LexisNexis Risk Solutions UK Limited | Enrichment & screening services | Core, V6/7, Mobius, IHP, Ratings (AWS, Ireland) |
| Loqate (a data controller) | Address verification and lookup | Core, Digital Services |
| North Door | Sanctions | V6 |
| Opayo / Elevon | Provision of vendor hosted payment iFrames or hosted redirects that Open GI embeds within its applicable solutions | V6/V7 |
| Open Dialog AI Limited | Virtual Assistant | Digital web platforms (AWS EU) |
| Percayso Inform Limited | Enrichment | Core, IHP, Ratings, V6/V7 (AWS, UK) |
| PremFina Limited | Premium Finance (UK) | Core, V6/V7 |
| Synectics Solutions Limited | Client screening fraud checking | Core, Mobius, V6/V7 |
| Vast Visibility Limited | Aggregator | Core, Mobius |
| Verisk Limited | Enrichment, screening, and address lookup services | Core, V6/7, Mobius, IHP, Ratings |
This page was last updated 12 October 2026. Please check back regularly for updates.
Last update made: Addition of Deloitte (various locations) to assist Open GI with platform migration processes and other technology improvements. Although we envisage that only depersonalised or test data may be accessed, some access to or visibility of client data may be required.
i A processor that engages another processor for carrying out specific processing activities on behalf of the controller. The same data protection obligations as set out in the contract or other legal act between the controller and the processor shall be imposed on that other processor by way of a contract or other legal act under local or member state law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the GDPR. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor’s obligations.ational measures in such a manner that the processing will meet the requirements of the GDPR. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor’s obligations.
ii ‘Recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.