Subprocessors & Data Sharing

Lycia Limited uses carefully selected third-party providers where needed to deliver, secure or support its services. The role of each provider depends on the service being used and the applicable contractual and legal arrangements.

Lycia maintains a controlled internal register recording provider role, service, processing location, contractual safeguards, international-transfer mechanism where required, review date and responsible owner. The register is updated when a material provider arrangement changes.

Only providers actually enabled for a Lycia service receive data for that service. A provider appearing in this summary does not mean that every client's data is sent to that provider.

Some providers may process data outside the UK. Where a restricted transfer occurs, Lycia applies an appropriate UK transfer mechanism and assesses whether supplementary safeguards are required.

• UK adequacy regulations where the destination is covered by an adequacy decision
• UK International Data Transfer Agreement (IDTA) where appropriate
• UK Addendum to the EU Standard Contractual Clauses where appropriate
• A permitted UK GDPR Article 49 derogation only for the specific circumstances in which it lawfully applies

Transfer details are maintained in Lycia's controlled International Transfer Register.

Lycia reviews material changes to providers and, where required by applicable law or contract, provides appropriate notice before a new subprocessor arrangement takes effect.

Where necessary and lawful, Lycia may also share information with:

• Professional advisers such as legal, tax and audit advisers
• Banks and payment providers
• Regulators, courts and law-enforcement bodies where legally required
• Counterparties or advisers specifically authorised by the client

Each disclosure is limited to what is necessary for the relevant purpose and remains subject to applicable confidentiality and data-protection obligations.