Snapshot 232986
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Schedule Public
Version 3.0
28 April 2026
Notes: * Nasstar uses component based model in the solution architecture proposed to customers. So not all Service Sub-Processors apply for
• Capitalised words and phrases in the table below shall have the same meaning given to them in Nasstar's Data Processing Terms all customers. Support Sub-Processors like ServiceNow and Cisco Call Recording apply when customer contacts access Nasstar Support.
e.g. CRM Data & Communications Data. ** Refers to Nasstar products and services supported by Nasstar Malaysia. Nasstar Group also use ServiceNow and various Microsoft
• "C" references where Nasstar is a Controller of the personal data and "P" references where Nasstar is a Processor of the personal Office applications (e.g. Exchange (e-mail), Teams, Skype for Business) to provide support to customers. ServiceNow affiliates in the UK,
data. US, the Netherlands, Australia, India and Singapore may access personal data for this purpose. Microsoft and ServiceNow utilise
• Nasstar uses a support service operated by its affiliate, ACT Teleconferencing Malaysia Sdn Bhd (based in Kuala Lumpar) ("Nasstar European Commission approved Standard Contractual Clauses for any non-EEA processing of personal data.
Malaysia") and it is possible that customer data may be accessed by Nasstar Malaysia in order for Nasstar Group to provide *** References to Sensitive Data shall mean Special Categories of Personal Data as set out in Article 9 of the General Data Protection
provisioning, support and maintenance services to its customers. The Nasstar Group uses European Commission approved Regulation 2016 and any information relating to criminal offences or convictions.
Standard Contractual Clauses to regulate the processing of personal data by Nasstar Malaysia; as well as Nasstar's Intra Group
Data Transfer Agreement and technical and organisation measures documented within the organisation's Integrated Business
Management System (IBMS). The IBMS conforms to ISO/IEC 27001, 20000-1, and 9001, and undergoes annual audit
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Web Hosting C P N/A P P P P P
Business contact details (e.g, Contact details for the None Any information which is Sensitive Data - Individuals ServiceNow. Support is ServiceNow provide support User Data and Content Data
name, job title, company Customer's admin and related hosted on Nasstar may share their sensitive managed using ServiceNow for managed services which is hosted in Nasstar UK data
name and business e-mail commmunications. infrastructure and which is personal data or about other (with customer data hosted in means that Customer data centres.
address/phone number and uploaded by the Customer users in the form of Content London and Amsterdam). may be processed in the US,
records of when using Nasstar's Web Data which Nasstar employees Cisco Call Recording. Calls to Australia, India and Singapore.
correspondence/marketing) Hosting services - note that may have access to in hosting the Support are recorded Cisco Call Recording. Calls to
for Nasstar's Customer Content Data is not accessed the website or in providing using Cisco Call Recording for the Support are recorded
contact(s)) which is used by or used by Nasstar other than support, but it is not required quality improvement purpose. using Cisco Call Recording for
Nasstar Group for the purpose to provide hosting services or requested by Nasstar to quality improvement purpose.
of sending B2B marketing, and any necessary support perform the services and
billing and customer services. Nasstar is not the controller of
relationship management any sensitive data
purposes.
VMCS (Virtual Machine C P N/A P P P P P
Continuity Software)
Business contact details (e.g, Contact details for the None Any information which is Sensitive Data - Individuals ServiceNow. Support is ServiceNow provide support User Data and Content Data
name, job title, company Customer's admin and related hosted on Nasstar may share their sensitive managed using ServiceNow for managed services which is hosted in Nasstar UK data
name and business e-mail commmunications and details infrastructure using Nasstar's personal data or about other (with customer data hosted in means that Customer data centres.
address/phone number and of any Customer end-users VMCS services - note that users in the form of Content London and Amsterdam). may be processed in the US,
records of who use the VMCS service. Content Data is not accessed Data which Nasstar employees Cisco Call Recording. Calls to Australia, India and Singapore.
correspondence/marketing) or used by Nasstar other than may have access to in hosting the Support are recorded Cisco Call Recording. Calls to
for Nasstar's Customer to provide hosting services the data or in providing using Cisco Call Recording for the Support are recorded
contact(s)) which is used by and any necessary support support, but it is not required quality improvement purpose. using Cisco Call Recording for
Nasstar Group for the purpose services. or requested by Nasstar to quality improvement purpose.
of sending B2B marketing, perform the services and
billing and customer Nasstar is not the controller of
relationship management any sensitive data
purposes.
Page 1 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
SecureVault C P N/A P P P P P
Business contact details (e.g, Contact details for the N/A Any information which is Sensitive Data - Individuals ServiceNow. Support is ServiceNow provide support User Data and Content Data
name, job title, company Customer's admin and related hosted on Nasstar may share their sensitive managed using ServiceNow for managed services which is hosted in Nasstar UK data
name and business e-mail commmunications and details infrastructure using Nasstar's personal data or about other (with customer data hosted in means that Customer data centres.
address/phone number and of any Customer end-users SecureVault service - note that users in the form of Content London and Amsterdam). may be processed in the US,
records of who use the SecureVault Content Data is not accessed Data which Nasstar employees Cisco Call Recording. Calls to Australia, India and Singapore.
correspondence/marketing) service. or used by Nasstar other than may have access to in hosting the Support are recorded Cisco Call Recording. Calls to
for Nasstar's Customer to provide hosting services the data or in providing using Cisco Call Recording for the Support are recorded
contact(s)) which is used by and any necessary support support, but it is not required quality improvement purpose. using Cisco Call Recording for
Nasstar Group for the purpose services. or requested by Nasstar to quality improvement purpose.
of sending B2B marketing, perform the services and
billing and customer Nasstar is not the controller of
relationship management any sensitive data
purposes.
Private Cloud C P N/A P P P P P
Business contact details (e.g, Contact details for the N/A Any information which is Sensitive Data - Individuals ServiceNow. Support is ServiceNow provide support User Data and Content Data
name, job title, company Customer's admin and related hosted on Nasstar may share their sensitive managed using ServiceNow for managed services which is hosted in Nasstar UK data
name and business e-mail commmunications and details infrastructure using Nasstar's personal data or about other (with customer data hosted in means that Customer data centres.
address/phone number and of any Customer end-users Private Cloud service - note users in the form of Content London and Amsterdam). may be processed in the US,
records of who use the Private Cloud that Content Data is not Data which Nasstar employees Cisco Call Recording. Calls to Australia, India and Singapore.
correspondence/marketing) service. accessed or used by Nasstar may have access to in hosting the Support are recorded Cisco Call Recording. Calls to
for Nasstar's Customer other than to provide hosting the website or in providing using Cisco Call Recording for the Support are recorded
contact(s)) which is used by services and any necessary support, but it is not required quality improvement purpose. using Cisco Call Recording for
Nasstar Group for the purpose support services. or requested by Nasstar to quality improvement purpose.
of sending B2B marketing, perform the services and
billing and customer Nasstar is not the controller of
relationship management any sensitive data
purposes.
Page 2 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Public Cloud C P P P P P
Business contact details (e.g, Contact details for the N/A Nasstar would only have Sensitive Data - Individuals ServiceNow. Support is Customer data is hosted using N/A
name, job title, company Customer's admin and related access to Content Data in may share their sensitive managed using ServiceNow Microsoft Azure cloud
name and business e-mail commmunications and details the provision of 1st and personal data or about other (with customer data hosted in infrastructure which means
address/phone number and of any Customer end-users 2nd line support (Nasstar users in the form of Content London and Amsterdam). that Customer data may be
records of who use the Public Cloud public cloud does not Data which Nasstar employees Cisco Call Recording. Calls to processed in the United States
correspondence/marketing) service. host the customer's data may have access to in hosting the Support are recorded and other non-EEA countries -
for Nasstar's Customer on Nasstar infrastructure, the website or in providing using Cisco Call Recording for Microsoft utilises Standard
contact(s)) which is used by this is provided by support, but it is not required quality improvement purpose. Contractual Clauses.
Nasstar Group for the purpose Microsoft Azure). or requested by Nasstar to ServiceNow provide support
of sending B2B marketing, perform the services and for managed services which
billing and customer Nasstar is not the controller of means that Customer data
relationship management any sensitive data may be processed in the US,
purposes. Australia, India and Singapore.
Cisco Call Recording. Calls to
the Support are recorded
using Cisco Call Recording for
quality improvement purpose.
Nasstar as a Reseller - C P P P P P P
Managed Services
Business contact details (e.g, Contact details for the Any Comms Data which is Any Content Data which is Sensitive Data - Individuals ServiceNow. Support is Microsoft. Customer data Where applicable,
name, job title, company Customer's admin and related necessary for Nasstar to necessary for Nasstar to may share their sensitive managed using ServiceNow may be processed in the Professional Service is
name and business e-mail commmunications and details provide trouble-shooting provide trouble-shooting personal data or about other (with customer data hosted in United States and other non- provided by working directly
address/phone number and of any Customer end-users services (this would only be in services e.g. screen-shots or users in the form of Content London and Amsterdam). EEA countries - Microsoft in the service partner hosted
records of who use the Managed exceptional circumstances). information provided as part Data which Nasstar employees Microsoft applications are utilises Standard Contractual administrative/partner
correspondence/marketing) Services (including details of of an incident. may have access to in hosting used to communicate with Clauses. ServiceNow provide portals.
for Nasstar's Customer any relevant third parties the website or in providing customers (e.g. e-mail, support for managed services
contact(s)) which is used by where relevant to an incident) support, but it is not required Skype/Teams) and some which means that Customer
Nasstar Group for the purpose or requested by Nasstar to personal data may be data may be processed in the
of sending B2B marketing, perform the services and contained within these US, Australia, India and
billing and customer Nasstar is not the controller of communications. Singapore.
relationship management any sensitive data Cisco Call Recording. Calls to Cisco Call Recording. Calls to
purposes. the Support are recorded the Support are recorded
using Cisco Call Recording for using Cisco Call Recording for
quality improvement purpose. quality improvement purpose.
Service Partner. When
partner services are
contracted solely by Nasstar
to customer and partner
fulfills the services.
Page 3 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Managed Services, C P P P P P P
Flexible Support
Business contact details (e.g, Contact details for the Any Comms Data which is Any Content Data which is Sensitive Data - Individuals ServiceNow. Support is Microsoft. Customer data Where applicable,
name, job title, company Customer's admin and related necessary for Nasstar to necessary for Nasstar to may share their sensitive managed using ServiceNow may be processed in the Professional Service is
name and business e-mail commmunications and details provide trouble-shooting provide trouble-shooting personal data or about other (with customer data hosted in United States and other non- provided by working directly
address/phone number and of any Customer end-users services (this would only be in services e.g. screen-shots or users in the form of Content London and Amsterdam). EEA countries - Microsoft in the
records of who use the Managed exceptional circumstances). information provided as part Data which Nasstar employees Microsoft applications are utilises Standard Contractual administrative/partner
correspondence/marketing) Services (including details of of an incident. may have access to in hosting used to communicate with Clauses. ServiceNow provide portals.
for Nasstar's Customer any relevant third parties the website or in providing customers (e.g. e-mail, support for managed services
contact(s)) which is used by where relevant to an incident) support, but it is not required Skype/Teams) and some which means that Customer
Nasstar Group for the purpose or requested by Nasstar to personal data may be data may be processed in the
of sending B2B marketing, perform the services and contained within these US, Australia, India and
billing and customer Nasstar is not the controller of communications. Singapore.
relationship management any sensitive data Cisco Call Recording. Calls to Cisco Call Recording. Calls to
purposes. the Support are recorded the Support are recorded
using Cisco Call Recording for using Cisco Call Recording for
quality improvement purpose. quality improvement purpose.
Co-Location C P P
Business contact details (e.g, Contact details for the N/A N/A N/A N/A N/A Nasstar's co-location
name, job title, company Customer's admin and related services involve the
name and business e-mail commmunications. housing of customer's
address/phone number and hardware in Nasstar's
records of premises but without
correspondence/marketing) any physical or logical
for Nasstar's Customer access rights. As
contact(s)) which is used by such, Nasstar processes
Nasstar Group for the purpose very little customer
of sending B2B marketing, personal data in the
billing and customer provision of co-location
relationship management services and would only
purposes. expect to process CRM Data
(C)
Page 4 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Cloud Workspace C P P P P P
Business contact details (e.g, End user account names in N/A Any records containing Sensitive Data - Individuals ServiceNow. Support is ServiceNow provide support
name, job title, company format personal data will be may share their sensitive managed using ServiceNow for managed services which
name and business e-mail firstname.lastname@business hosted on Nasstar Group personal data or about other (with customer data hosted in means that Customer data
address/phone number and Customer administrators’ infrastructure in the UK. users in the form of Content London and Amsterdam). may be processed in the US,
records of account log-on in format Data which Nasstar employees Cisco Call Recording. Calls to Australia, India and Singapore.
correspondence/marketing) firstname.lastname@business may have access to in hosting the Support are recorded Cisco Call Recording. Calls to
for Nasstar's Customer . Any customer user data the website or in providing using Cisco Call Recording for the Support are recorded
contact(s)) which is used by which is held in the solution is support, but it is not required quality improvement purpose. using Cisco Call Recording for
Nasstar Group for the purpose potentially visible to a or requested by Nasstar to quality improvement purpose.
of sending B2B marketing, Nasstar administrator. perform the services and
billing and customer Nasstar is not the controller of
relationship management any sensitive data
purposes.
Secure E-mail C P P P P P P P
Business contact details (e.g, Details of end-users to Details of emails sent End-users of the Customer will Sensitive Data - Individuals ServiceNow. Support is ServiceNow provide support Customer data is hosted in
name, job title, company support end-user retrieval of to / from a given email transmit information over may share their sensitive managed using ServiceNow for managed services which Nasstar Group UK data
name and business e-mail quarantined messages. address are recorded email routinely which may personal data or about other (with customer data hosted in means that Customer data centres (and other third
address/phone number and by the SecureMail contain personal data (and users in the form of Content London and Amsterdam). may be processed in the US, party data centres in the
records of service. which Nasstar may have Data which Nasstar employees Cisco Call Recording. Calls to Australia, India and Singapore. UK).
correspondence/marketing) This metadata includes access to in providing Secure E- may have access to in hosting the Support are recorded Cisco Call Recording. Calls to
for Nasstar's Customer date / time information mail services and support). the website or in providing using Cisco Call Recording for the Support are recorded
contact(s)) which is used by and is stored within the support, but it is not required quality improvement purpose. using Cisco Call Recording for
Nasstar Group for the purpose system to support or requested by Nasstar to quality improvement purpose.
of sending B2B marketing, troubleshooting in the perform the services and
billing and customer event of issues with the Nasstar is not the controller of
relationship management service, or investigation any sensitive data
purposes. in to network activity.
This metadata includes: IP
Address, Device
ID, Routing Information,
Source / Destination IP
addresses visited
Page 5 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Microsoft Office 365 C P P P P P P
including Copilot
Business contact details (e.g, Users Name, Name, Job Title, Email, Phone, N/A Sensitive Data - Individuals ServiceNow. Support is Customer data will be Nasstar is a reseller of
name, job title, company Email Address, Tel no, Site Location, Reporting Line, Call may share their sensitive managed using ServiceNow provided to Microsoft in its Microsoft Office 365
name and business e-mail location, Job Quality, IP Address, MAC personal data or about other (with customer data hosted in capacity as vendor which products and proceses & a
address/phone number and title, User address, Microsoft users in the form of Content London and Amsterdam). means that Customer data limited amount of
records of screen shot, Tenant ID Data which Nasstar employees Cisco Call Recording. Calls to may be processed in the customer information
correspondence/marketing) Survey may have access to in hosting the Support are recorded United States and other non- as the product/service
for Nasstar's Customer responses the website or in providing using Cisco Call Recording for EEA countries - Microsoft is provided by
contact(s)) which is used by support, but it is not required quality improvement purpose. utilises Standard Contractual Microsoft and customer
Nasstar Group for the purpose or requested by Nasstar to Clauses. ServiceNow provide data is hosted on
of sending B2B marketing, perform the services and support for managed services Microsoft infrastructure.
billing and customer Nasstar is not the controller of which means that Customer Support tickets are
relationship management any sensitive data data may be processed in the managed using
purposes. US, Australia, India and ServiceNow.
Singapore.
Cisco Call Recording. Calls to
the Support are recorded
using Cisco Call Recording for
quality improvement purpose.
Hosted Antivirus C P P P P P
Business contact details (e.g, Contact details for the N/A To support trouble-shooting Sensitive Data - Individuals ServiceNow. Support is It is possible that personal N/A
name, job title, company Customer's admin and related (only in exceptional may share their sensitive managed using ServiceNow data provided by the customer
name and business e-mail commmunications and details circumstances e.g. screen- personal data or about other (with customer data hosted in in connection with the
address/phone number and of any Customer end-users shots + remote access for users in the form of Content London and Amsterdam) incident will be shared with
records of who use the Hosted Anti-virus support services). Data which Nasstar employees Kaspersky. Where an incident Kaspersky in Russia to
correspondence/marketing) services for the purpose of may have access to in hosting with the software cannot be investigate/resolve the
for Nasstar's Customer ensuring application of the website or in providing resolved by Nasstar, it may be incident. ServiceNow provide
contact(s)) which is used by policies based on individual support, but it is not required escalated to Kaspersky. support for managed services
Nasstar Group for the purpose users/groups of end-users + or requested by Nasstar to Cisco Call Recording. Calls to which means that Customer
of sending B2B marketing, asset/device information for perform the services and the Support are recorded data may be processed in the
billing and customer management purposes (+ may Nasstar is not the controller of using Cisco Call Recording for US, Australia, India and
relationship management include user name, device any sensitive data quality improvement purpose. Singapore.
purposes. name, IP address, MAC Cisco Call Recording. Calls to
address and log of websites the Support are recorded
visited by end-user where web- using Cisco Call Recording for
filtering is enabled). quality improvement purpose.
Page 6 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
EM&S (Enterprise N/A N/A N/A N/A N/A N/A N/A N/A
Mobility & Security)
N/A N/A N/A N/A N/A N/A N/A No personal data is
processed by Nasstar in
respcet of EM&S as this is a
'grouped product' which is
only provided in addition to
another Nasstar Product
(e.g. MS Office 365). For
customers who purchase
EM&S, please see the
entries for the relevant
Nasstar products.
Datto (discontinued) – C P P P p p P
moved to SecureVault
Business contact details (e.g, Contact details for the N/A To support trouble-shooting Sensitive Data - Individuals ServiceNow. Support is ServiceNow provide support Datto is a discontinued
name, job title, company Customer's admin and related (only in exceptional may share their sensitive managed using ServiceNow for managed services which product and this service will
name and business e-mail commmunications and details circumstances e.g. screen- personal data or about other (with customer data hosted in means that Customer data move to Nasstar SecureVault
address/phone number and of any Customer end-users shots + remote access for users in the form of Content London and Amsterdam. may be processed in the US, (see above). Note that
records of who use the Datto services. support services). Nasstar’s Data which Nasstar employees Datto. May process back-up Australia, India and Singapore. support service requests are
correspondence/marketing) deployment and may have access to in hosting copies of customer data if Cisco Call Recording. Calls to managed using
for Nasstar's Customer support teams have the the website or in providing customer elects to use Datto the Support are recorded ServiceNow. Software
contact(s)) which is used by ability to see and access support, but it is not required back-ups. using Cisco Call Recording for vendor
Nasstar Group for the purpose any data held in Datto. or requested by Nasstar to Cisco Call Recording. Calls to quality improvement purpose. is Datto. Datto software
of sending B2B marketing, perform the services and the Support are recorded is held on Nasstar
billing and customer Nasstar is not the controller of using Cisco Call Recording for infrastructure. No
relationship management any sensitive data quality improvement purpose. support services are
purposes. provided by Datto.
Datto may store back- ups of
Customer data
at Datto's EEA data
centres depending on
whether the customer
elects to use Nasstar or
Datto infrastructure.
Page 7 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Veeam Cloud Connect C P P P P P P
Business contact details (e.g, Contact details for the N/A To support trouble-shooting Sensitive Data - Individuals ServiceNow. Support is ServiceNow provide support All Customer data is held on
name, job title, company Customer's admin and related (only in exceptional may share their sensitive managed using ServiceNow for managed services which Nasstar Group datacentres
name and business e-mail commmunications and details circumstances e.g. screen- personal data or about other (with customer data hosted in means that Customer data in the UK other than back-
address/phone number and of any Customer end-users shots + remote access for users in the form of Content London and Amsterdam). may be processed in the US, ups held by Veeam (at the
records of who use the Veeam Cloud support services). Any Data which Nasstar employees Veeam. If a customer elects Australia, India and Singapore. Customer's request/option),
correspondence/marketing) Connect services. Content Data is potentially may have access to in hosting for back-ups of their data to Cisco Call Recording. Calls to which are held in the EEA.
for Nasstar's Customer visible to internal the website or in providing be maintained by Veeam, this the Support are recorded
contact(s)) which is used by administrators but in order to support, but it is not required will be held in Veaam's EEA using Cisco Call Recording for
Nasstar Group for the purpose do so Nasstar/s customer or requested by Nasstar to data-centres. quality improvement purpose.
of sending B2B marketing, wouldneed to equest GVI to perform the services and Cisco Call Recording. Calls to
billing and customer request Veeam to open the Nasstar is not the controller of the Support are recorded
relationship management data. any sensitive data using Cisco Call Recording for
purposes. quality improvement purpose.
Managed WAN / LAN / C P P P C P P
Wireless LAN Services
Business contact details (e.g, Name, Job Title, Email, Phone, IP Address The Customer can send Nasstar monitor the ServiceNow. Support is ServiceNow provide support N/A
name, job title, company Location, IP Address, MAC MAC address any data they wish to network for utilisation managed using ServiceNow for managed services which
name and business e-mail address, Browsing history by over this service and and packet loss (with customer data hosted in means that Customer data
address/phone number and Ticket History/Log Details MAC/IP address is Nasstar Group doesn’t control statistics including London and Amsterdam). may be processed in the US,
records of available to the or network devices. Autotask. Support/incident Australia, India and Singapore.
correspondence/marketing) customer as well as have visibility of it. No sensitive data management software. Cisco Call Recording. Calls to
for Nasstar's Customer location of these within Metadata logs and other event Supportworks. Support- the Support are recorded
contact(s)) which is used by a building where the logs (not full payloads of incident management using Cisco Call Recording for
Nasstar Group for the purpose LAN is available. traffic) for management software. quality improvement purpose.
of sending B2B marketing, Traffic logs – Session analytics and reporting LogicMonitor. Provider of Fortinet, Cisco, Cisco Meraki,
billing and customer information cloud hosted network and Logic Monitor, HPE
relationship management (source/destination IP performance platform Aruba, Draytek, Alcatel.
purposes. addresses, MAC addresses, Fortinet, Cisco, Cisco Meraki, Provider of cloud hosted
ports, protocols, bytes HPE Aruba, Draytek, Alcatel network and application
sent/received) Provider of cloud hosted platform may host data in US
Event logs – System events, network and application
admin activity, firmware performance platform.
upgrades Comms365 3rd line support +
Authentication logs – User delivery of SIM cards to
logins/logouts, customers
RADIUS/LDAP/SAML NetScout. DDOS protection
authentication attempts cloud service is used when
attack size exceeds capacity of
on-prem deployment.
Telecoms providers including
BT Wholesale, Virgin Media
Business, Platform X
Communications, Neos
Security Managed C P P P C P P
Services - Threat
Detection and Response
Service
Page 8 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Business contact details (e.g, Name, Job Title, Email, Phone, Incidentally accessed when Incidentally accessed when N/A Sentinel SIEM. Cloud native ServiceNow provide support N/A
name, job title, company Location, IP Address, MAC services monitor network incident response services are SIEM solution for managed services which
name and business e-mail address, traffic or emails. provided. NormCyber. Provides security means that Customer data
address/phone number and Ticket History/Log Details monitoring services, may be processed in the US,
records of SmartBloc Australia, India and Singapore.
correspondence/marketing) Microsoft Identity. cloud Cisco Call Recording. Calls to
for Nasstar's Customer identity services. the Support are recorded
contact(s)) which is used by Microsoft Defender. using Cisco Call Recording for
Nasstar Group for the purpose Intregated security solution quality improvement purpose.
of sending B2B marketing, Qualys. Vulnerability
billing and customer Scanning.
relationship management Microsoft O365. Email
purposes. communication and file
storage.
ServiceNow. Support is
managed using ServiceNow
(with customer data hosted in
London and Amsterdam)
Cisco Call Recording. Calls to
the Support are recorded
using Cisco Call Recording for
quality improvement purpose.
Page 9 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Security Managed C NA NA NA P NA NA C
Services - Nasstar
Security Advisor
Business contact details (e.g, NA NA NA Professional Service is NA NA ServiceNow - used for
name, job title, company provided by working within internal activity tracking
name and business e-mail the customer environment
address/phone number and and is subject to customer's Microsoft O365 - emails and
records of Information Security and file storage for reports
correspondence/marketing) Handling policies. generated.
for Nasstar's Customer
contact(s)) which is used by
Nasstar Group for the purpose
of sending B2B marketing,
billing and customer
relationship management
purposes.
Page 10 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Managed SD-WAN / C P P P C P P
Firewall / SD-Branch
Services
Business contact details (e.g, Name, Job Title, Email, Phone, FortiCloud, Cisco Meraki, The Customer can send Nasstar monitor the ServiceNow. Support is ServiceNow provide support N/A
name, job title, company Location, IP Address, MAC Nasstars' Fortiportal - logs any data they wish to network for utilisation managed using ServiceNow for managed services which
name and business e-mail address, metadata and other event logs over this service and and packet loss (with customer data hosted in means that Customer data
address/phone number and Ticket History/Log Details (not full payloads of traffic) for Nasstar Group doesn’t control statistics including London and Amsterdam). may be processed in the US,
records of management analytics and or network devices. Autotask. Support/incident Australia, India and Singapore.
correspondence/marketing) reporting, including: have visibility of it. No sensitive data management software. Cisco Call Recording. Calls to
for Nasstar's Customer Traffic logs – Session Metadata logs and other event Supportworks. Support- the Support are recorded
contact(s)) which is used by information logs (not full payloads of incident management using Cisco Call Recording for
Nasstar Group for the purpose (source/destination IPs MAC traffic) for management software. quality improvement purpose.
of sending B2B marketing, addresses, ports, protocols, analytics and reporting. LogicMonitor. Provider of Fortinet, Cisco Meraki, and
billing and customer bytes sent/received) cloud hosted network LogicMonitor. Provider of
relationship management Event logs – System events, performance platform cloud hosted network,
purposes. admin activity, firmware Fortinet, Cisco Meraki. application and security
upgrades Provider of cloud hosted platform may host data in US
Security logs – (IPS), Antivirus network, application and
detections, security platform which
Web filtering activity, collects User activity data,
Application control events, network application traffic and
DLP (Data Loss Prevention) security events data
events, Botnet and malicious Comms365 3rd line support +
traffic detection delivery of SIM cards to
VPN logs – Connection customers
attempts, failures, established NetScout. DDOS protection
sessions cloud service is used when
Authentication logs – User attack size exceeds capacity of
logins/logouts, on-prem deployment.
RADIUS/LDAP/SAML Telecoms providers including
authentication attempts BT Wholesale, Virgin Media
Page 11 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Nasstar Hosted Voice C P P P P P P P
Services including Teams
Direct Routing, Contact
Centre, Call Recording Business contact details (e.g, Customer end-users and Device IDs (IP/MAC address), Any content created by an end- Sensitive Data - Individuals Microsoft; Microsoft. (non-EEA Microsoft Skype for Business
name, job title, company admins: personal contact location data (for emergency user and may include photos, may share their sensitive Nasstar Group Intra-Group processing including US). (syncs with Customer's
name and business e-mail details [name, address, phone contacts/service/ELIN - subnet videos, screen/file/video personal data or about other transfers (US, Australia and Nasstar Group may process Active Directory (selected
address/phone number and number], photos (from and physical address sharing, e-mail content, call users in the form of Content Malaysia); personal data through its fields)) - Processes user data
records of customer's active directory), information) and traffic recordings, video, photo (from Data which Nasstar employees Enghouse (Contact Centre); subsidiaries in the US, (user/SIP names, numbers,
correspondence/marketing) videos, screen/file sharing data/routing information and customer's active directory). may have access to in hosting Workstream People (Contact Australia and Malaysia. org details, e.g. role/loc) for
for Nasstar's Customer data, e-mail content data, caller ID info; the website or in providing Centre); Enghouse + Workstream set up, function and
contact(s)) which is used by device IDs (IP/MAC address), support, but it is not required Verint (call-recording); People. US; Verint. North reporting; SBCs, Acme
Nasstar Group for the purpose location data, caller ID info + or requested by Nasstar to Code/CLOBBR (UC Analytics Macedonia, Israel, US, Mexico, Packets for SfB) - Process
of sending B2B marketing, emergency contact info (ELIN). perform the services and Product); Brazil, India, Hong Kong, user data for call routing;
billing and customer Nasstar is not the controller of Nuvias (Hardware support inc Indonesia + Australia; Provide user data for
relationship management any sensitive data Acme SBCs; inc. Siphon Nuvias. (UK, Dubai); inclusion in call records*
purposes. Networks); Cisco (Contact Centre); (origin/destination
Cisco (Contact Centre); ServiceNow (Support) numbers, IP addresses,
ServiceNow (Support) user/SIP names). Contact
Centre (Enghouse
EICC/CCSP) and Call
Recording (Verint Verba) -
3rd party apps hosted on
Nasstar servers in the UK.
QoE (Microsoft) and UC
Analytics used for platform
monitoring and analytics.
WER (Nasstar Group
number management tool)
used to enable routing.
Page 12 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Nasstar Managed C P P P P P P P
Services including
Support Services,
Business contact details (e.g, Customer end-users and Comms Data may be shared Any content created by an end- Sensitive Data - Individuals Microsoft Azure cloud hosting Microsoft (non-EEA processing Support is managed using
name, job title, company admins: personal contact for trouble-shooting/support user and may include videos, may share their sensitive and applications/services; including US). Nasstar Group ServiceNow (London,
name and business e-mail details (name, address, phone e.g. screen-shots and log-files screen/file sharing data, email personal data or about other Nasstar Group Intra-Group may process personal data Amsterdam, US, Australia,
address/phone number and number), photos (optional for & may include device IDs content data, users in the form of Content transfers (US, Australia and through its subsidiaries in the India and Singapore).
records of contacts in ServiceNow), (IP/MAC address), location Data which Nasstar employees Malaysia); US, Australia and Malaysia. Services are provided using
correspondence/marketing) videos (may be included with data, traffic data/routing may have access to in hosting Power Admin LLC PA LastPass process personal data Power Admin LLC PA
for Nasstar's Customer support tickets in information, Websites visited the website or in providing Monitoring system monitoring in the US. ServiceNow provide Monitoring tool (system
contact(s)) which is used by ServiceNow), screen/file (as part of troubleshooting), support, but it is not required tool LastPass support for managed services monitoring tool) and
Nasstar Group for the purpose sharing data (as part of but is not routinely processed or requested by Nasstar to customer password which means that Customer Lastpass (Customer
of sending B2B marketing, troubleshooting or recordings by Nasstar Group for perform the services and repository; data may be processed in the password management
billing and customer provided with support tickets), Professional Services. Nasstar is not the controller of Cisco (Contact Centre); US, Australia, India and tool).
relationship management e-mail content data (e-mails any sensitive data ServiceNow (Support) Singapore.
purposes. may be provided with support AWS cloud hosting and serv Cisco (Contact Centre);
tickets), device IDs (IP/MAC ices ServiceNow (Support)
address), location
data,traffic/routing dat, caller
ID info, Employee ID (as part
of video managed services).
Nasstar Professional C P P P P P P P
Services including
consultancy &
project/change
management
Business contact details (e.g, Customer's staffend-users: Device ID (IP address/MAC Any content created by an end- Sensitive Data - Individuals Microsoft Azure cloud hosting Microsoft (non-EEA processing Project data may include
name, job title, company contact details address), location data, traffic user. may share their sensitive and applications/services; including US). Nasstar Group some Customer personal
name and business e-mail (name/address/business e- data/routing info, caller ID personal data or about other Nasstar Group Intra-Group may process personal data data which is processed
address/phone number and mail + phone number); video, info users in the form of Content transfers (US, Australia and through its subsidiaries in the using the 'Projector'
records of screen/file sharing, e-mail Data which Nasstar employees Malaysia); US, Australia and Malaysia. application which is hosted
correspondence/marketing) content, device ID (IP may have access to in hosting Cisco (Contact Centre); LastPass process personal data on Nasstar Group data-
for Nasstar's Customer address/MAC address), the website or in providing ServiceNow (Support) in the US. ServiceNow provide centres in the UK
contact(s)) which is used by location data, traffic support, but it is not required support for managed services
Nasstar Group for the purpose data/routing info, caller ID or requested by Nasstar to which means that Customer
of sending B2B marketing, info. perform the services and data may be processed in the
billing and customer Nasstar is not the controller of US, Australia, India and
relationship management any sensitive data Singapore.
purposes. Cisco (Contact Centre);
ServiceNow (Support)
Nasstar SaaS including C C P P P
Teamwork Analytics,
OneConsultation,
OneMeeting &
CreateTeam
Page 13 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Business contact details (e.g, Customer's end-users: End-users: location data, caller End-users: any content Sensitive Data - Individuals Auth0 identity management IPWhois (servers located N/A
name, job title, company personal contact details ID info created by an end-user and may share their sensitive (EU hosted tenant); globally, non-EEA processing)
name and business e-mail (name, address, telephone shared through a SaaS service personal data or about other IPWhois IP geolocation Microsoft (non-EEA processing
address/phone number and number etc.), date of birth, (Nasstar Group will not users in the form of Content solution; including US). Nasstar Group
records of videos, SMS/MMS data, routinely access this data Data which Nasstar employees Microsoft Azure cloud hosting may process personal data
correspondence/marketing) screen/file sharing, email other than for trouble- may have access to in hosting and applications/services; through its subsidiaries in the
for Nasstar's Customer content data, device IDs (IP shooting/support reasons) the website or in providing Nasstar Group Intra-Group US, Australia and Malaysia.
contact(s)) which is used by Address/MAC Address), caller support, but it is not required transfers (US, Australia and Pexip (EEA); Twilio (US, UK
Nasstar Group for the purpose ID info, Customer's O365 or requested by Nasstar to Malaysia); including non-EEA
of sending B2B marketing, profile data/credentials, User perform the services and Pexip: video bridging processing);
billing and customer name/SIP address, public IP Nasstar is not the controller of manufacturer Sendgrid (US, UK, including
relationship management address any sensitive data Twilio: SMS solution non-EEA processing);
purposes. SendGrid - email solution; Cisco (Contact Centre);
Cisco (Contact Centre); ServiceNow (Support)
ServiceNow (Support)
Microsoft Licencing C
Business contact details (e.g, N/A N/A N/A N/A Microsoft Azure cloud hosting N/A Microsoft CSP Portals are
name, job title, company for CSP Portals. hosted in the UK/EU/EEA.
name and business e-mail Cloudmore Cloudmore CSP
address/phone number and Portal Microsoft (Azure)-resident
records of Azure Virtual Desktop application hosted in the
correspondence/marketing) EU/EEA.
for Nasstar's Customer
contact(s)) which is used by
Nasstar Group for the purpose
of sending B2B marketing,
billing and customer
relationship management
purposes.
Nasstar Project Based
Professional and Support
Service Subprocessors
Actiance - Compliance Actiance - India and US Nasstar may use this
Recording; Authorised Sub-Processor to
AGAT - Sphereshield provide products and
services to customers.
AGAT - Sphereshield (Security AGAT - Israel (EU Adequacy Nasstar may use this
product) Decision) Authorised Sub-Processor to
provide products and
services to customers.
Altigen - Contact Centre in the Altigen - US Nasstar may use this
UK and US Authorised Sub-Processor to
provide products and
services to customers.
Arrow - SBC distribution and Arrow - APAC Nasstar may use this
support Authorised Sub-Processor to
provide products and
services to customers.
Page 14 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Cloud Business - Sharepoint N/A Nasstar may use this
consultancy in the UK Authorised Sub-Processor to
provide products and
services to customers.
Competella - Contact Centre Competella - India Nasstar may use this
in Sweden, Norway, Denmark Authorised Sub-Processor to
and India provide products and
services to customers.
Fastlane - UA Pro Servs in UK N/A Nasstar may use this
& Germany Authorised Sub-Processor to
provide products and
services to customers.
GTT - Sophos network support GTT - Global including non- Nasstar may use this
EEA countries Authorised Sub-Processor to
provide products and
services to customers.
IOMmart - data centres IOMmart - Global including Nasstar may use this
non-EEA countries Authorised Sub-Processor to
provide products and
services to customers.
Kemp - Load Kemp - Global including non- Nasstar may use this
Balancers/reverse proxy EEA countries Authorised Sub-Processor to
manufacturer provide products and
services to customers.
Kinly - AV services in the UK N/A Nasstar may use this
Authorised Sub-Processor to
provide products and
services to customers.
Landis - AttendPro & other Landis - US Nasstar may use this
Landis apps Authorised Sub-Processor to
provide products and
services to customers.
Northamber - Kemp N/A Nasstar may use this
distribution and support in the Authorised Sub-Processor to
UK provide products and
services to customers.
Nuvias - Hardware support inc Nuvias - Dubai Nasstar may use this
Acme SBCs including Siphon Authorised Sub-Processor to
Networks in the UK, Europe provide products and
and Dubai services to customers.
Project Vision - IT network UK Nasstar may use this
support for Sophos customer Authorised Sub-Processor to
provide products and
services to customers.
Point Sharp - Security N/A Nasstar may use this
software (Sweden) Authorised Sub-Processor to
provide products and
services to customers.
Page 15 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Poly - End-user/room device Poly - Global including non- Nasstar may use this
manufacturer EEA countries Authorised Sub-Processor to
provide products and
services to customers.
Pure-IP - SIP carrier Pure-IP - Global including non- Nasstar may use this
EEA countries Authorised Sub-Processor to
provide products and
services to customers.
Redstor - Backup solutions in N/A Nasstar may use this
the UK Authorised Sub-Processor to
provide products and
services to customers.
SCC AVS - AV services & UK
equirement
Screencult - Video production UK
(ACM content)
Techland - SBC distribution & N/A Nasstar may use this
support in the UK Authorised Sub-Processor to
provide products and
services to customers.
Tecnomic - Audiocodes Tecnomic - Australia Nasstar may use this
reseller Authorised Sub-Processor to
provide products and
services to customers.
NinjaOne - Remote NinjaOne - US, UK, EU, Nasstar may use this
monitoring and management Australia Authorised Sub-Processor to
(RMM) provide products and
services to customers.
Page 16 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Microsoft Office 365 C P P C P P P
Business contact details (e.g, Administrator’s name, Job IP Address MAC address when N/A Nasstar Group monitor the ServiceNow. Support is ServiceNow provide support Support is managed using
name, job title, company Title, Email, Phone, Location, using NAT, originators private network for utilisation and managed using ServiceNow for managed services which ServiceNow (London,
name and business e-mail IP Address, MAC address, IP address can be obtained packet loss statistics including (with customer data hosted in means that Customer data Amsterdam, US, Australia,
address/phone number and Ticket History/Log Details network devices and in so London and Amsterdam). BT may be processed in the US, India and Singapore) and
records of doing could process personal Wholesale - PSTN access Australia, India and Singapore. 'Matilda' for customers in
correspondence/marketing) data in the form of device IDs circuits, TalkTalk Cisco Call Recording. Calls to Ireland (hosted on Nasstar
for Nasstar's Customer e.g. IP/MAC addresses + call Business - data access circuits, the Support are recorded Group data centres in the
contact(s)) which is used by records. Virgin Media - PSTN access using Cisco Call Recording for UK). Customer contact
Nasstar Group for the purpose circuits, quality improvement purpose. details may be shared with
of sending B2B marketing, Vodafone - PSTN access third parties for
billing and customer circuits commissioning,
relationship management Xtel - on-site engineering decommissioning & support
purposes. services. (BT Wholesale - PSTN access
Cisco Call Recording. Calls to circuits, TalkTalk Business -
the Support are recorded data access circuits, Virgin
using Cisco Call Recording for Media - PSTN access circuits,
quality improvement purpose. Vodafone - PSTN access
circuits and Xtel - on-site
engineering services)
Page 17 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Nasstar Contact Services C P P P P&C P P P
including OmniChannel,
Inbound, Outbound and
Call Recording
Business contact details (e.g, Name, Job Title, Email, Phone, Name, Job Title, Email, Phone, Interaction data i.e. records of Network monitoring/routing ServiceNow. Support is Microsoft (non-EEA) It is All Customer data is
name, job title, company Location, Reporting Line, Call Location, Reporting Line, Call interactions between info for the purpose of managed using ServiceNow possible that support may be processed by Nasstar Group
name and business e-mail Quality, IP Address, MAC Quality, IP Address, MAC Customer's staff and other monitoring the Nasstar (with customer data hosted in required from Microsoft and members using Nasstar
address/phone number and address, Call History/Log address, Call History/Log individuals using the contact contact center serve (C) London and Amsterdam). Max that Customer data in respect Group data centres in the
records of Details, Agent Profile & Skills, Details, Agent Skills, Hold Centre (Max Contact) product Sensitive Data - Individuals Contact Limited - support and of a support request is UK and Microsoft Azure data-
correspondence/marketing) Hold location data and map location data and map address including IM, call recording, may share their sensitive hosting in the UK processed by Microsoft centres in the UK region
for Nasstar's Customer address for for emergency/number video recording and screen personal data or about other Cisco Call Recording. Calls to outside the EEA including the operated by Max Contact
contact(s)) which is used by emergency/number contact. Agent interaction recording. users in the form of Content the Support are recorded US. Microsoft utilises Limited for Nasstar Group.
Nasstar Group for the purpose contact.The Contact Centre times and functions recorded Data which Nasstar employees using Cisco Call Recording for Standard Contractual Clauses 3rd line support is provided
of sending B2B marketing, Software is set to a Fixed IP against activity; may have access to in hosting quality improvement purpose. for non-EEA processing. by Max Contact imited in the
billing and customer Address range for security the website or in providing ServiceNow provide support UK.
relationship management which means that Nasstar support, but it is not required for managed services which
purposes. have an IP address range and or requested by Nasstar to means that Customer data
device type (in some cases). perform the services and may be processed in the US,
Nasstar is not the controller of Australia, India and Singapore.
any sensitive data (P). Cisco Call Recording. Calls to
the Support are recorded
using Cisco Call Recording for
quality improvement purpose.
Smart Messenger C P P P P P p P
including SMS, Smart
Chat, Smart Vouchers
and Smart Coupons Business contact details (e.g, End-users of Nasstar Recipients mobile number, IP Any content created by the Sensitive Data - Individuals ServiceNow. Support is ServiceNow provide support All Customer data is
name, job title, company customers + customer admins Address is logged for API Customer and used as part of may share their sensitive managed using ServiceNow for managed services which processed by Nasstar Group
name and business e-mail + third parties (e.g. connections, MAC and device the Smart Messenger service personal data or about other (with customer data hosted in means that Customer data members using Nasstar
address/phone number and callers/called parties). For end-ID if available, Message (e.g. messages, coupons, users in the form of Content London and Amsterdam). may be processed in the US, Group data centres in the
records of users: name and e-mail routing information, Recipient surveys etc.) Data which Nasstar employees Sinch UK Limited - Australia, India and Singapore. UK.
correspondence/marketing) address, MD5 hashed message History/Log Details; may have access to in hosting route/parse messages to Cisco Call Recording. Calls to
for Nasstar's Customer password and photo; the website or in providing networks the Support are recorded
contact(s)) which is used by support, but it is not required Cisco Call Recording. Calls to using Cisco Call Recording for
Nasstar Group for the purpose or requested by Nasstar to the Support are recorded quality improvement purpose.
of sending B2B marketing, perform the services and using Cisco Call Recording for
billing and customer Nasstar is not the controller of quality improvement purpose.
relationship management any sensitive data
purposes.
Mobile Self Service C P P P P P P
including Docs Delivered,
Nasstar Identity and Full
Voice Self Service
Page 18 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Business contact details (e.g, Contact details for the Recipients mobile number, IP Message/document content Sensitive Data - Individuals ServiceNow. Support is ServiceNow provide support Mobile Self Service are
name, job title, company Customer's admin and related Address is logged for API may share their sensitive managed using ServiceNow for managed services which derivative products of
name and business e-mail commmunications and details connections, MAC and device personal data or about other (with customer data hosted in means that Customer data Nasstar Talk. Mobile Self
address/phone number and of any Customer end-users ID if available, Message users in the form of Content London and Amsterdam). may be processed in the US, Service is integrated through
records of who use Mobile Self Service routing information, Recipient Data which Nasstar employees Xtreme Internet Solutions Australia, India and Singapore. APIs with Smart Messenger
correspondence/marketing) including Name, Email message History/Log Details may have access to in hosting BVBA (t/a Coupon Tools) - Cisco Call Recording. Calls to (see above). Docs Delivered
for Nasstar's Customer address, MD5 Hashed the website or in providing powers 'Docs Delivered' the Support are recorded uses a platform provided by
contact(s)) which is used by password, photo support, but it is not required platform using Cisco Call Recording for Xtreme Internet Solutions
Nasstar Group for the purpose or requested by Nasstar to Sinch UK Limited - quality improvement purpose. BVBA in Belgium t/a Coupon
of sending B2B marketing, perform the services and route/parse messages to Tools. Any SMS messages
billing and customer Nasstar is not the controller of networks are sent via mobile network
relationship management any sensitive data Cisco Call Recording. Calls to operators (e.g. EE,
purposes. the Support are recorded Vodafone, and O2) using an
using Cisco Call Recording for SMSC aggregator (Sinch/CLX
quality improvement purpose. Communications). Voice
products (e.g. Nasstar
Identity and Voice Self-
Service) are further
described in Nasstar Talk
(see below).
Nasstar Talk including C P P P P P P P
TalkTeams, TalkLive,
CloudIVR and Talk
Analytics Business contact details (e.g, Contact details for the IP Address, MAC address, Call Interactions between Sensitive Data - Individuals ServiceNow. Support is ServiceNow provide support Customer data is hosted at
name, job title, company Customer's admin and related History/Log Details - individuals who use Nasstar may share their sensitive managed using ServiceNow for managed services which Boom Limited's data-centres
name and business e-mail commmunications and details caller/called party data and Talk Services including IM, MS personal data or about other (with customer data hosted in means that Customer data in the UK and the
address/phone number and of any Customer end-users video recording and screen TEAMS calls, video recording users in the form of Content London and Amsterdam). may be processed in the US, Netherlands and Level 3 and
records of who use the Nasstar Contact recording meta-data and screen recording. Data which Nasstar employees Boom Limited - data centres Australia, India and Singapore. Level 4 support is provided
correspondence/marketing) services including Name, Job may have access to in hosting in UK and Netherlands & Cisco Call Recording. Calls to by Boom Limited.
for Nasstar's Customer Title, TEAMS details, Phone, the website or in providing support services. the Support are recorded
contact(s)) which is used by Reporting Line, Call Quality, IP support, but it is not required Cisco Call Recording. Calls to using Cisco Call Recording for
Nasstar Group for the purpose Address, MAC address, Call or requested by Nasstar to the Support are recorded quality improvement purpose.
of sending B2B marketing, History/Log Details, perform the services and using Cisco Call Recording for
billing and customer Nasstar is not the controller of quality improvement purpose.
relationship management any sensitive data
purposes.
PCI – Nasstar AgentPay, C P P
SecureContract, VoicePay
and AutoPay
Page 19 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Business contact details (e.g, No personal data is processed No personal data is processed No personal data is processed No personal data is processed ServiceNow. Support is ServiceNow provide support Any payment card data is
name, job title, company through these Nasstar through these Nasstar through these Nasstar through these Nasstar managed using ServiceNow for managed services which processed through SPEIK or
name and business e-mail solutions and payment card solutions and payment card solutions and payment card solutions and payment card (with customer data hosted in means that Customer data C3 products and data-
address/phone number and data is parsed to the data is passed to the data is parsed to the data is parsed to the London and Amsterdam). may be processed in the US, centres in the UK - Nasstar
records of Customer's PSP - any end-user Customer's PSP. Customer's PSP. Customer's PSP. Aeriandi Ltd (SPEIK). PCI Australia, India and Singapore. has no access to or visibility
correspondence/marketing) data processed by Nasstar compliant products and data- Cisco Call Recording. Calls to of payment card data held in
for Nasstar's Customer would be processed through centres in the UK (for the Support are recorded SPEIK or C3 servers.
contact(s)) which is used by other Nasstar solutions e.g. AgentPay & VoicePay). using Cisco Call Recording for
Nasstar Group for the purpose Nasstar Talk or Nasstar Computer & Communications quality improvement purpose.
of sending B2B marketing, Contact Centre Co. Limited (C3). PCI
billing and customer compliant products and data-
relationship management centres in the UK (for
purposes. SecureContract & AutoPay).
Cisco Call Recording. Calls to
the Support are recorded
using Cisco Call Recording for
quality improvement purpose.
PCI - Nasstar WebPay C P P P P P P P
Business contact details (e.g, End-users of Nasstar End-users of Nasstar End-users of Nasstar Sensitive Data - Individuals ServiceNow. Support is ServiceNow provide support Chatbot uses Converse 360
name, job title, company customers - IP address customers - Chat content (e.g. customers - any Chat content may share their sensitive managed using ServiceNow for managed services which software and data-centres in
name and business e-mail would include time- (e.g. messages/conversations) personal data or about other (with customer data hosted in means that Customer data the UK and PCI sessions use
address/phone number and stamps/data-stamps) users in the form of Content London and Amsterdam). may be processed in the US, SPEIK software and PCI-DSS
records of Data which Nasstar employees Converse360 - chatbot Australia, India and Singapore. compliant data-centres in
correspondence/marketing) may have access to in hosting software & support Cisco Call Recording. Calls to the UK (PCI card data is
for Nasstar's Customer the website or in providing Aeriandi Ltd (SPEIK). PCI the Support are recorded parsed to the Customer's
contact(s)) which is used by support, but it is not required compliant products and data- using Cisco Call Recording for PSP and is not processed by
Nasstar Group for the purpose or requested by Nasstar to centres in the UK (for quality improvement purpose. Nasstar - Nasstar has no
of sending B2B marketing, perform the services and AgentPay & VoicePay). access to or visibility of
billing and customer Nasstar is not the controller of Cisco Call Recording. Calls to payment card data held in
relationship management any sensitive data the Support are recorded SPEIK servers).
purposes. using Cisco Call Recording for
quality improvement purpose.
Page 20 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Nasstar Routing (WER) C P P C P P
Business contact details (e.g, Contact details for the Phone numbers allocated to N/A Disclosure of Customer's ServiceNow. Support is ServiceNow provide support Customer data is held on
name, job title, company Customer's admin + Nasstar customer, routing emergency contract may be managed using ServiceNow for managed services which Nasstar datacentres in the
name and business e-mail emergency contact and information that is allocated made to emergency services (with customer data hosted in means that Customer data UK and Shout Telecom
address/phone number and related commmunications + to each of the Nasstar's where there is a silent or London and Amsterdam). may be processed in the US, datacentres in the UK.
records of details of any end-users (e.g. customers allocated numbers, abandoned call - customer Shout Telecom - support Australia, India and Singapore.
correspondence/marketing) caller/called number) CLI data if specific routing or emergency contact details services Cisco Call Recording. Calls to
for Nasstar's Customer blocking is required, third pary would be provided if Cisco Call Recording. Calls to the Support are recorded
contact(s)) which is used by data e.g. Caller ID requested for this purpose. the Support are recorded using Cisco Call Recording for
Nasstar Group for the purpose using Cisco Call Recording for quality improvement purpose.
of sending B2B marketing, quality improvement purpose.
billing and customer
relationship management
purposes.
Page 21 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Internet Access (including C P P C&P P P P
broadband services,
Direct Internet Access,
Internet Breakout and
Internet Connect)
Business contact details (e.g, Contact details for the Data usage (CDRs) IP Address N/A CPE IP address is used for Telecoms providers including ServiceNow provide support Support is managed through
name, job title, company Customer's admin and related is stored for remote status monitoring (C) and BT Wholesale, Virgin Media for managed services which Autotask (UK & EEA) and
name and business e-mail commmunications management and support. remote support and Business, Platform X means that Customer data ServiceNow (London,
address/phone number and Data routing information, management (P). No sensitive Communications, Neos may be processed in the US, Amsterdam, US, Australia,
records of Usage History / Log Details; data. Networks, ITS Technology Australia, India and Singapore. India and Singapore) &
correspondence/marketing) Group, CityFibre and KCOM. Cisco Call Recording. Calls to ServiceNow (London,
for Nasstar's Customer ServiceNow. Support is the Support are recorded Amsterdam, US, Australia,
contact(s)) which is used by managed using ServiceNow using Cisco Call Recording for India and Singapore).
Nasstar Group for the purpose (with customer data hosted in quality improvement purpose.
of sending B2B marketing, London and Amsterdam).
billing and customer Autotask. Support
relationship management management (UK & EEA).
purposes. Comms365. CPE management
portal, 3rd line support +
delivery of SIM cards to
customers
NetScout. DDOS protection
cloud service is used when
attack size exceeds capacity of
on-prem deployment.
Sphere Global. Ordering 3rd
party access circuits for
connectivity products.
LogicMonitor. Provider of
cloud hosted network
performance platform.
Cisco Call Recording. Calls to
the Support are recorded
Page 22 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Mobile Services C P P C&P P P P
(including SIMs, Rapid
Network Development)
Business contact details (e.g, Contact details for the IP Address is stored for N/A IP address is used for status ServiceNow. Support is ServiceNow provide support Support is managed through
name, job title, company Customer's admin and related remote management and monitoring (C) and remote managed using ServiceNow for managed services which Autotask (UK & EEA) and
name and business e-mail commmunications support. support and management (P). (with customer data hosted in means that Customer data ServiceNow (London,
address/phone number and No sensitive data. London and Amsterdam). may be processed in the US, Amsterdam, US, Australia,
records of LogicMonitor. Provider of Australia, India and Singapore. India and Singapore) &
correspondence/marketing) cloud hosted network Cisco Call Recording. Calls to ServiceNow (London,
for Nasstar's Customer performance platform. the Support are recorded Amsterdam, US, Australia,
contact(s)) which is used by Autotask. Support using Cisco Call Recording for India and Singapore).
Nasstar Group for the purpose management (UK & EEA). quality improvement purpose.
of sending B2B marketing, Comms365 - CPE
billing and customer management portal, 3rd line
relationship management support + delivery of SIM
purposes. cards to customers
Cisco Call Recording. Calls to
the Support are recorded
using Cisco Call Recording for
quality improvement purpose.
Professional Services - C NA NA NA P NA NA NA
Systems Development
and Implementation
Services, Security
Assessments,
Infrastructure Review
Assessments, Bespoke
Assessments, AI
Solutions, Cloud
Solutions and Data
Solutions
Business contact details (e.g, NA NA NA Professional Service is NA NA
name, job title, company provided by working within
name and business e-mail the customer environment
address/phone number and and is subject to customer's
records of Information Security and
correspondence/marketing) Handling policies.
for Nasstar's Customer
contact(s)) which is used by
Nasstar Group for the purpose
of sending B2B marketing,
billing and customer
relationship management
purposes.
Inbound Telephony C P P P P
Service S
Page 23 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Business contact details (e.g, Contact details for the Call history/log details - Interaction data i.e. records of Data may include sensitive European Computer
name, job title, company Customer's admin and related caller/called party data. interactions between data in the form of Content Telecoms (ECT) provide third
name and business e-mail commmunications and details Customer's staff and other Data which Nasstar employees line support for the platform.
address/phone number and of any Customer end-users individuals using the Service may have access to in
records of who use the Inbound including call recordings for providing support, but it is not
correspondence/marketing) Telephony Service (including those Customers who use the required or requested by
for Nasstar's Customer end user telephone number). Service's call recording Nasstar to perform the
contact(s)) which is used by facilities. Services and Nasstar is not the
Nasstar Group for the purpose controller of any sensitive
of sending B2B marketing, data.
billing and customer
relationship management
purposes.
Inbound Voice Services C P P P P
via the Advance Services
Platform
Business contact details (e.g, Contact details for the Call history/log details - Interactions between Data sent across the Advanced Telsis and Shout provide 4th
name, job title, company Customer's admin and related caller/called party data - and individuals who use the Services Platform may include line support for some
name and business e-mail commmunications and details similar records for faxes. Service including call sensitive data in the form of elements of the Myriad
address/phone number and of any end-users who use or recordings and voicemail Content Data which Nasstar platform that these Services
records of deal with the Service provided messages for those Customers employees may have access to relate to.
correspondence/marketing) by Nasstar to the Customer who use the Service's call in providing support, but it is
for Nasstar's Customer (including end user telephone recording and voicemail not required or requested by
contact(s)) which is used by number). facilities. Inbound and Nasstar to perform the
Nasstar Group for the purpose outbound fax is also used. Services and Nasstar is not the
of sending B2B marketing, controller of any sensitive
billing and customer data.
relationship management
purposes.
Page 24 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
C P P P P
Inbound Voice (Reseller)
Business contact details (e.g, Contact details for the Call history/log details - Interactions between Data may include sensitive ECT provide third line support
name, job title, company Customer's admin and related caller/called party data. individuals who use the data in the form of Content for the platform.
name and business e-mail commmunications and details Service including call Data which Nasstar employees
address/phone number and of any end-users who use or recordings for those may have access to in
records of deal with the Service provided Customers who use the providing support, but it is not
correspondence/marketing) by Nasstar to the Customer Service's call recording required or requested by
for Nasstar's Customer (including end user telephone facilities. Nasstar to perform the
contact(s)) which is used by number). Services and Nasstar is not the
Nasstar Group for the purpose controller of any sensitive
of sending B2B marketing, data.
billing and customer
relationship management
purposes.
C P P P P
SIP Trunking Services
Business contact details (e.g, Contact details for the MAC address or IP address, N/A N/A Microsoft ( Metaswitch) -
name, job title, company Customer's admin and related call history/log details Acesss to call logs , IP address
name and business e-mail commmunications and details for 3rd line diagnostic
address/phone number and of any Customer end-users purposes,
records of who use the Service.
correspondence/marketing)
for Nasstar's Customer
contact(s)) which is used by
Nasstar Group for the purpose
of sending B2B marketing,
billing and customer
relationship management
purposes.
Page 25 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
C P P P P
SIP Trunking Services
(Reseller)
Business contact details (e.g, Contact details for the MAC address or IP address, N/A N/A Microsoft ( Metaswitch) -
name, job title, company Customer's admin and related call history/log details Acesss to call logs , IP address
name and business e-mail commmunications and details for 3rd line diagnostic
address/phone number and of any end-users who use or purposes,
records of deal with the Service provided
correspondence/marketing) by Nasstar to the Customer.
for Nasstar's Customer
contact(s)) which is used by
Nasstar Group for the purpose
of sending B2B marketing,
billing and customer
relationship management
purposes.
C P P P P
SmartComms UC Service
Business contact details (e.g, Contact details for the Device IDs (IP/MAC address), Any content created by an end- Data may include sensitive BT Wholesale
name, job title, company Customer's admin and related location data (for emergency user and may include audio data in the form of Content Wholesale carrier of access
name and business e-mail commmunications and details contacts/service/ELIN - subnet and video recordings, IM Data which Nasstar employees circuits.
address/phone number and of Customer end-users and and physical address content and email content. may have access to in wholesale portal business
records of admins who use the Service information) and traffic Voice recordings are providing support, but it is not zone and business portal
correspondence/marketing) including: Login/User ID, data/routing information (e.g. encrypted and can only be required or requested by Tolring - call logs with
for Nasstar's Customer personal contact details communication start & end accessed by authorised users Nasstar to perform the associated user info at
contact(s)) which is used by (name, address, phone time, user details (identifying Services and Nasstar is not the company , site and user level
Nasstar Group for the purpose number, email address), from & to users), caller ID info, controller of any sensitive
of sending B2B marketing, calendar information, location call details including From and data.
billing and customer data, usage details of To telephone numbers,
relationship management communications technical details relating to
purposes. (video/audio/messaging), call technical quality of the
history/log details, videos, communication).
screen/file sharing data, IM
content data, email content
data, device IDs (IP/MAC
address).
Page 26 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
SmartComms UC Service C P P P P
(Partner & Reseller)
Business contact details (e.g, Contact details for the Device IDs (IP/MAC address), Any content created by an end- Data may include sensitive BT Wholesale
name, job title, company Customer's admin and related location data (for emergency user and may include audio data in the form of Content Wholesale carrier of access
name and business e-mail commmunications and details contacts/service/ELIN - subnet and video recordings, IM Data which Nasstar employees circuits.
address/phone number and of end-users and admins who and physical address content and email content. may have access to in wholesale portal business
records of use the Service (including staff information) and traffic Voice recordings are providing support, but it is not zone and business portal
correspondence/marketing) of the End User Customer) data/routing information (e.g. encrypted and can only be required or requested by Tolring - call logs with
for Nasstar's Customer including: Login/User ID, communication start & end accessed by authorised users Nasstar to perform the associated user info at
contact(s)) which is used by personal contact details time, user details (identifying Services and Nasstar is not the company , site and user level
Nasstar Group for the purpose (name, address, phone from & to users), caller ID info, controller of any sensitive
of sending B2B marketing, number, email address), call details including From and data.
billing and customer calendar information, location To telephone numbers,
relationship management data, usage details of technical details relating to
purposes. communications technical quality of the
(video/audio/messaging), call communication).
history/log details, videos,
screen/file sharing data, IM
content data, email content
data, device IDs (IP/MAC
address).
Signalling Presentation C P P P P
Business contact details (e.g, Contact details for the Call history/log details - N/A N/A This Service is always sold /
name, job title, company Customer's admin and related caller/called party data. associated with another
name and business e-mail commmunications and details voice product (either
address/phone number and of any Customer end-users Inbound or SIP or both). The
records of who use the Service. data processing
correspondence/marketing) characteristics will be the
for Nasstar's Customer same as the main product
contact(s)) which is used by
Nasstar Group for the purpose
of sending B2B marketing,
billing and customer
relationship management
purposes.
Page 27 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
Point to point Leased C P P P P
Line, Ethernet and
Optical Layer 2 Services
Business contact details (e.g, Name, Job Title, Email, Phone, IP Address N/A N/A Telecoms providers including ServiceNow provide support
name, job title, company Location, IP Address, MAC MAC address BT Wholesale, Virgin Media for managed services which
name and business e-mail address, Ticket History/Log Business, Platform X means that Customer data
address/phone number and Details Communications, Neos may be processed in the US,
records of Networks, ITS Technology Australia, India and Singapore.
correspondence/marketing) Group, CityFibre and KCOM. Cisco Call Recording. Calls to
for Nasstar's Customer the Support are recorded
contact(s)) which is used by Sphere Global. Ordering 3rd using Cisco Call Recording for
Nasstar Group for the purpose party access circuits for quality improvement purpose.
of sending B2B marketing, connectivity products.
billing and customer
relationship management Xtel, Infradata + Commscare.
purposes. Onsite engineering services.
Managed Hosting C P P P P
Services
Business contact details (e.g, Contact details for the N/A Any information which is Sensitive Data - Individuals Abiquo
name, job title, company Customer's admin and related hosted on Nasstar may share their sensitive Microsoft applications are
name and business e-mail commmunications and details infrastructure using Nasstar's personal data or about other used to communicate with
address/phone number and of any Customer end-users Managed Hosting Services - users in the form of Content customers (e.g. e-mail,
records of who use the Service. note that Content Data is not Data which Nasstar employees Skype/Teams) and some
correspondence/marketing) accessed or used by Nasstar may have access to in hosting personal data may be
for Nasstar's Customer other than to provide hosting the data or in providing contained within these
contact(s)) which is used by services and any necessary support, but it is not required communications.
Nasstar Group for the purpose support services. or requested by Nasstar to Netapp
of sending B2B marketing, perform the services and
billing and customer Nasstar is not the controller of
relationship management any sensitive data.
purposes.
Page 28 of 29
Data Processing Schedule Public
Version 3.0
28 April 2026
CRM Data User Data Communications Data Content Data (this would Other (incl. Sensitive Data) Authorised Sub-Processors* Non-EEA Processing of Additional Info
(this is the personal data of (this is focussed on a (this will include a range of cover a range of data that is Customer Data by Nasstar as
representatives with whom customer's end users e.g. their traffic and location data that processed in the provision of Processor**
Nasstar Product/Service Nasstar interacts for contact details and Nasstar will process in order Nasstar's services but which is
marketing and customer authentication details, among to perform certain services created by users – ranging
relationship purposes) other things) (e.g. number called, from video, call and email
date/time, duration of call) content data)
C P P P P
Wide Area Networks,
MPLS, Private Broadband
and Network Connect
Business contact details (e.g, Name, Job Title, Email, Phone, IP Address N/A Nasstar monitor the Telecoms providers including BT ServiceNow provide support for
name, job title, company Location, IP Address, MAC MAC address network for utilisation Wholesale, Virgin Media managed services which means
name and business e-mail address, Ticket History/Log CLI/telephone number (ADSL and packet loss Business, Platform X that Customer data may be
Communications, Neos processed in the US, Australia,
address/phone number and Details monitoring) statistics including
Networks, ITS Technology India and Singapore.
records of network devices. Group, CityFibre and KCOM. Cisco Call Recording. Calls to the
correspondence/marketing) No sensitive data ServiceNow. Support is managed Support are recorded using Cisco
for Nasstar's Customer using ServiceNow (with customer Call Recording for quality
contact(s)) which is used by data hosted in London and improvement purpose.
Nasstar Group for the purpose Amsterdam).
of sending B2B marketing, Autotask. Support management
billing and customer (UK & EEA).
NetScout. DDOS protection cloud
relationship management
service is used when attack size
purposes.
exceeds capacity of on-prem
deployment.
Sphere Global. Ordering 3rd
party access circuits for
connectivity products.
LogicMonitor. Provider of cloud
hosted network performance
platform.
Cisco Call Recording. Calls to the
Support are recorded using Cisco
Call Recording for quality
improvement purpose.
Xtel, Infradata + Commscare.
Onsite engineering services.
Cloud Connect C P P P P
Business contact details (e.g, Contact details for the IP Address N/A Nasstar monitor the Megaport. Connectivity from ServiceNow provide support for
name, job title, company Customer's admin and related MAC address network for statistics including Nasstar to cloud service managed services which means
name and business e-mail commmunications. network devices. provider points of that Customer data may be
processed in the US, Australia,
address/phone number and No sensitive data interconnect
India and Singapore.
records of Sphere Global. Ordering 3rd Cisco Call Recording. Calls to the
correspondence/marketing) party access circuits for Support are recorded using Cisco
for Nasstar's Customer connectivity products. Call Recording for quality
contact(s)) which is used by LogicMonitor. Provider of improvement purpose.
Nasstar Group for the purpose cloud hosted network
of sending B2B marketing, performance platform.
billing and customer Cisco Call Recording. Calls to
relationship management the Support are recorded
purposes. using Cisco Call Recording for
quality improvement purpose.
Page 29 of 29