Data Processing and Subprocessor Statement

TD & Partners Global acts as a data controller for information collected through our website, enquiries, recruitment and our own operations. Where we deliver services to a client that involve processing the client's personal data on the client's instructions, we generally act as a data processor under a written agreement that sets out our obligations.

As a controller, we determine the purposes and means of processing our own personal data and comply with applicable data-protection law, as described in our Global Privacy Notice. We are accountable for that processing and for responding to individuals' requests where we are the controller.

As a processor, we process personal data only on the documented instructions of the client, under a contract that meets applicable legal requirements. We do not use client personal data for our own purposes and we assist clients in meeting their obligations where agreed.

We rely on sub-processors to help us operate our website, host systems, provide security, and deliver services. We engage sub-processors under contracts that require appropriate confidentiality, security and compliance with data-protection law. We limit sub-processor access to what is necessary.

Principal categories include website hosting and infrastructure, analytics (where consented), form and content management, email and communications, and security tooling. Specific providers may change over time; we maintain an internal register and will provide reasonable information on request.

Where sub-processors transfer personal information internationally, we rely on appropriate safeguards such as standard contractual clauses or other lawful mechanisms. We assess transfers to ensure they provide a level of protection appropriate to the information.

We require sub-processors to maintain appropriate technical and organisational measures, as described in our Information Security Statement. We assess sub-processors before engagement and review them periodically where appropriate.

Where we add or replace sub-processors that process client personal data, we follow the notice and objection provisions in the relevant client agreement. For our own processing, we update this statement where material.

We review this statement regularly and update it when our processing arrangements change materially. The effective date and version are shown on the policy page.