Version: 1.0
Last updated: 03/06/26
Provider: Stow Quill Ltd trading as House Desk
This list is for customers who use House Desk to process staff and workplace data. It explains which third-party services may process personal data when providing the platform. Staff end users are not asked to accept this list on login.
About this list
Where House Desk acts as a processor for your organisation, we use trusted subprocessors to host, secure and operate the service. Subprocessors only receive personal data where needed to perform their function.
This list should be read with our Data Processing Agreement, Privacy Notice, and Data Retention Policy.
We may update subprocessors from time to time. Where required by our DPA, we will give customers notice of material changes and a reasonable opportunity to object on legitimate data protection grounds.
Key subprocessors
| Service | Provider | Purpose | Data involved | Location |
|---|---|---|---|---|
Google Firebase / Google Cloud Hosting & infrastructure Provider privacy info | Google Ireland Ltd / Google LLC | Core platform: authentication, database (Firestore), file storage, serverless functions, web app hosting, operational logging and security. | Staff profiles, workplace records (rotas, clock-in, timesheets, training, incidents, messages, documents), account data, technical logs, authentication identifiers. | United Kingdom / European Economic Area / United States (subject to safeguards) |
Firebase Authentication Authentication & transactional email Provider privacy info | User sign-in (email/password, phone verification where enabled), session management, password reset and account security emails. | Email address, phone number, user ID, authentication events. | United Kingdom / EEA / United States (subject to safeguards) | |
Firebase Cloud Messaging (FCM) Push notifications | Deliver web push notifications to authorised users who opt in on their device. | Device push tokens, notification content, delivery metadata. | United Kingdom / EEA / United States (subject to safeguards) | |
Stripe Payments Provider privacy info | Stripe Payments UK Ltd / Stripe Inc | Process subscription payments, billing portal, invoices and payment status for customer accounts (business billing contacts). | Billing contact name and email, business name, subscription and payment metadata. House Desk does not receive full card numbers. | United Kingdom / United States / other Stripe processing locations |
Google Places API Maps & place data (optional) Provider privacy info | Help customers link sites to place names and addresses during setup; may fetch public place and review metadata where enabled. | Site/venue search queries, place identifiers, formatted addresses, and public review metadata—not routine staff HR records. | United Kingdom / EEA / United States (subject to safeguards) | |
Open-Meteo Weather data (optional feature) Provider privacy info | Open-Meteo (community weather API) | Provide weather summaries for rota planning and demand signals where a customer enables weather features for a site. | Site coordinates (latitude/longitude) sent to retrieve forecast data. No staff names are required for this integration. | European Union (API operator location may vary) |
football-data.org Sports & events data (optional feature) Provider privacy info | football-data.org | Fetch public sports fixture information for demand-signal planning where enabled by a customer. | Fixture and competition metadata. Does not process identifiable staff data. | European Union / United Kingdom |
Optional or customer-controlled
- Payroll exports — CSV or similar files generated in House Desk for download by your organisation. Exports are prepared for use in your own payroll systems (for example Xero or other providers you choose). Those systems are your responsibility and are not House Desk subprocessors unless we add a direct API integration and list it here.
- Weather and sports features — only used when enabled for a site. They generally process location or public event data, not routine staff identity data.
- Google Places — used during site setup or demand-signal configuration, not for day-to-day roster processing.
Changes and enquiries
To request a copy of this list, ask about international transfers, or object to a new subprocessor on data protection grounds, contact privacy@bopple.co.uk.