What we buy
Templace is a small software company, so our supply chain is short. We buy:
- hosting for the Service, on a server in the United Kingdom;
- AI services from Anthropic PBC in the United States, used only for the Service's AI features;
- email services for our own notices;
- software tools and services we use to build and run the business;
- from time to time, professional advice and computer equipment.
Suppliers that handle personal data
Some suppliers handle personal data in the Service on agencies' behalf. These are our sub-processors. The current list, with each provider's name and location, is on the Sub-processors page of our terms at /terms. An agency's emails to its own people go through the agency's own mail server, not ours.
Before we appoint a sub-processor, we check that it can protect the data, and we put a written contract in place that gives the protection UK GDPR Article 28 requires, in line with our Data Processing Addendum with agencies. Where a sub-processor is outside the UK, we put a lawful transfer safeguard in place. For Anthropic PBC, that is the UK Addendum to the EU standard contractual clauses.
We tell agencies about any change to our sub-processors 30 days before it takes effect.
How we choose suppliers
Before we engage a supplier, we look at the risks it brings, in proportion to what it will do for us. We consider:
- what the supplier will do, and whether it will handle personal data or have access to our systems;
- its security and data protection terms;
- where it will hold or process data;
- its financial standing and reputation;
- its modern slavery statement, if it is large enough to publish one;
- its approach to bribery, tax and the fair treatment of its own workers.
What we expect of suppliers
We expect every supplier to:
- comply with the law, including data protection, anti-bribery, tax, modern slavery and employment law;
- keep our information, and our customers' information, confidential and secure;
- tell us promptly about any security incident or personal data breach that affects us or our customers;
- not use further sub-contractors to handle our customers' data without our agreement;
- treat their own workers fairly and pay them at least the legal minimum;
- tell us about any concern, including through our whistleblowing policy.
Paying suppliers
We pay suppliers on the terms we agree, against a valid invoice, into a bank account in the supplier's business name. We confirm any change to a supplier's bank details through a contact route we already know before we pay. We never act on an email alone.
Reviewing and ending relationships
We review our main suppliers, and every sub-processor, at least once a year. We review sooner if something changes, such as an incident, a change of ownership, or a change in where data is held.
If a supplier falls short of what we expect and does not put it right, we end the relationship as our contract allows. If that supplier is a sub-processor, we tell agencies as set out above.
Questions and review
Questions about our suppliers or this policy go to terry@hilliernet.co.uk. The Director approves this policy and reviews it at least once a year.
Our supply chain · version 1.0 · approved 27/10/2026 · next review 27/10/2027. Templace is a trading name of TWH Holdings Limited, company number 10663539, Meadway, Mill Road, Writhlington, Radstock, BA3 5TY.