Little Moo Limited
Sub-processor Register
The processors we rely on to deliver the services, and what each one handles.
Current authorised providers supporting Little Moo Hosting services
Contact: privacy@littlemoogroup.co.uk
Purpose and status
This register identifies the current authorised sub-processors and material software suppliers used by Little Moo Limited where they may process Customer Personal Data. It is maintained separately from the Data Processing Agreement so that it can remain accurate when suppliers change. Independent controllers such as payment providers, domain registries, registrars and certification authorities are described in the Privacy Policy and Data Processing Agreement and are not included here as sub-processors merely because they receive data.
| Provider | Purpose | Location and transfer position |
|---|---|---|
| 20i Limited | United Kingdom hosting infrastructure, StackCP control-panel services, network, email platform, DNS, security tooling, backups where activated, VPS infrastructure and technical support. | Customer hosting under UK plans is provisioned in London, United Kingdom. Limited account, diagnostic, support or onward-supplier processing is governed by 20i’s DPA and recorded by Little Moo where it constitutes a Restricted Transfer. |
| WHMCS Limited / WebPros | Self-hosted client portal, service management, invoicing, provisioning integration and support-ticket software. | The primary database and uploaded records are hosted in Little Moo’s UK hosting environment. Limited licensing, update, diagnostic or support information may be processed internationally under an applicable safeguard. |
| Microsoft Corporation and applicable affiliates | Business email, Teams, SharePoint, OneDrive, document storage and collaboration. | Eligible core tenant data is stored according to Microsoft’s applicable data-residency commitments. Limited support, security, diagnostic and service-generated data may be processed internationally under Microsoft’s contractual safeguards. |
| Xero group entities | Accounting, invoices, credit notes, reconciliation, reporting and statutory records. | Processing may occur in the UK and other countries used by Xero and its service providers. Applicable adequacy decisions and contractual transfer safeguards are used where required. |
| Approved freelance associates and subcontractors | Specialist design, development, content, administration or technical work performed on documented instructions. | The relevant location and safeguard are recorded before access is granted. No Restricted Transfer is authorised without an appropriate UK GDPR mechanism. |
Changes and objections
Little Moo gives affected customers at least 14 days written notice of an intended addition or replacement of a sub-processor. A customer may object on reasonable data-protection grounds within that period. The process and available remedy are set out in clause 7.3 of the Data Processing Agreement.
Important qualification
Supplier locations and safeguards can vary by service configuration. Before authorising access that would create a Restricted Transfer, Little Moo records the destination and the applicable UK GDPR mechanism, such as a UK adequacy regulation, the International Data Transfer Agreement or the UK Addendum. Customers requiring a particular residency or encryption control must notify Little Moo before provisioning so suitability can be confirmed in writing.
Artificial-intelligence providers
An AI provider is added to this register before it is permitted to process Customer Personal Data on Little Moo’s behalf. General-purpose AI tools must not receive passwords, payment-card information or other sensitive credentials. If no AI provider is listed here, Customer Personal Data must not be submitted to one.