This page lists the third-party service providers (Sub-processors) that Lens School Evaluation Ltd engages to deliver the Lens School Evaluation service. It is published in support of the Data Processing Agreement and the Privacy Policy; in the event of conflict, the DPA prevails.
How changes are notified
Lens will publish proposed changes to this list (the addition or replacement of any Sub-processor) on this page at least thirty (30) days before the change takes effect. Each change is recorded in the change log at the foot of this page, dated with both the publication date and the effective date.
To be notified by email when this page changes, write to [email protected] with the subject line Subscribe to sub-processor updates. Subscriptions can be cancelled at any time by replying Unsubscribe.
Customers may object to a proposed change for reasonable data-protection grounds before it takes effect, in accordance with clause 6.4 of the Data Processing Agreement. If Lens cannot reasonably accommodate the objection, the Customer may terminate the affected processing on written notice, with a pro-rata refund of any prepaid fees for the unused period.
Current Sub-processors
The following Sub-processors are currently engaged. Locations refer to where the Sub-processor processes Customer Data; the transfer mechanism column identifies the safeguard relied on under Chapter V UK GDPR for any processing outside the United Kingdom.
Primary infrastructure and Customer Data
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| DigitalOcean | Cloud hosting and primary infrastructure: compute, managed database and object storage where all Customer Data is held | United Kingdom | UK-resident infrastructure (no international transfer) |
| Cloudflare | TLS termination, content delivery, web application firewall and DDoS protection in front of the Service | Global edge; configuration administered from the United Kingdom | UK IDTA / UK Addendum to SCCs |
| OpenAI | AI-assisted analysis and summarisation of Customer Data on request. Training of OpenAI's models on Customer Data is contractually prohibited. | USA | UK IDTA / UK Addendum to SCCs |
Authentication (sign-in providers)
When an Authorised User signs in to the Service using Microsoft or Google, that provider receives the user's name, email address and profile metadata for the purpose of completing the sign-in. The Customer's own choice of identity provider determines whether this transfer occurs.
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Microsoft Corporation (Azure Active Directory) | Identity provider for sign-in via Microsoft 365 | EU / Global, per Microsoft's data residency | UK IDTA / UK Addendum to SCCs (where applicable) |
| Google LLC (Google Identity) | Identity provider for sign-in via Google Workspace | EU / Global, per Google's data residency | UK IDTA / UK Addendum to SCCs (where applicable) |
Billing and accounting
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Stripe | Payment processing, subscription management and invoicing. Card data is handled solely by Stripe and is not received by Lens. | USA / EU | UK IDTA / UK Addendum to SCCs |
| Intuit (QuickBooks) | Accounting and financial record-keeping | USA / EU | UK IDTA / UK Addendum to SCCs |
Customer support
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Zoho Corporation | Customer support desk and enquiry management | EU / USA | UK IDTA / UK Addendum to SCCs |
Observability and error monitoring
Lens uses a third-party error monitoring service to detect, diagnose and resolve software faults in the Service. When an application error occurs, limited diagnostic information — including stack traces, request URL and headers, browser and operating-system metadata, IP address and the contextual data needed to reproduce the fault — is transmitted to the Sub-processor below for review by Lens engineers. Lens configures the Sub-processor to scrub obvious personal data from error payloads.
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Sentry (Functional Software, Inc.) | Application error monitoring, performance monitoring and diagnostic logging for the Service | European Union (EU instance, hosted in Germany) | UK adequacy regulations for the EEA |
Lens's internal business operations
The following Sub-processor supports Lens's own internal operations rather than the routine delivery of the Service. Customer Data may be processed by it incidentally — for example, in the body of an email exchanged with a Customer's contact.
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Google LLC (Google Workspace) | Internal business communications and file management for Lens staff | Global; data residency configurable per Google Workspace settings | UK IDTA / UK Addendum to SCCs, and adequacy decisions where applicable |
Change log
Each material change to this list is recorded below. Where a change relates to a Sub-processor that will begin processing on a future date, both the publication date and the effective date are shown.
- 3 June 2026 — List version 1.1 published. Sentry (Functional Software, Inc.) added as a Sub-processor for application error monitoring, performance monitoring and diagnostic logging. Sentry is engaged on its EU instance, hosted in Germany. Publication date: 3 June 2026. Effective date: 3 July 2026 (30 days from publication, per clause 6.4 of the DPA). Customers may object on reasonable data-protection grounds before the effective date by writing to [email protected].
- 2 June 2026 — List version 1.0 published. Initial Sub-processor list comprising DigitalOcean, Cloudflare, OpenAI, Microsoft (Azure AD), Google (Identity and Workspace), Stripe, Intuit (QuickBooks) and Zoho.
Lens details
- Legal entity: Lens School Evaluation Ltd
- Company number: 13792467
- Registered address: Cae Knovil, Llandenny, Usk, Monmouthshire, NP15 1DL
- ICO registration number: ZC042775
- Data Protection Officer: Jamie Beer
- Data protection contact: [email protected]