Purpose and responsibility
This notice explains the different technical and organisational roles involved in USG data handling. It supplements the Privacy Policy and does not replace a service-specific processing schedule or a signed Data Protection Addendum.
Universal Sustainable Growth Organisation Ltd. is responsible for the website and services it operates directly. The actual function of a provider determines whether it acts as a processor, sub-processor or independent controller. A brand name, supplier headquarters or UK registered office does not, by itself, establish where every item of data is stored or accessed.
Separate processing activities
Application hosting, account authentication, permissions and database records support website and service operations. Their processing and access locations must be considered separately from publication storage and email. An administrative notification is not the complete underlying record.
OVHcloud is used for object storage supporting USG digital assets and publications. This does not mean that the website application, all databases, email or every backup also runs in the same service or region. Upload permissions and access conditions depend on the relevant asset and service.
Departmental correspondence is handled through USG’s business email arrangements. A mailbox may retain messages and attachments separately from an application database. Ordinary email should not be used to send government identity documents or confidential case material where a protected route is required.
The website’s transactional email implementation submits messages to Resend when that delivery service is configured, including account-verification and relevant service messages. This is distinct from a staff member receiving or replying through a business mailbox. Data may include recipient address, message content and delivery information needed for that message.
GitHub source control and separately authorised Vercel development or preview deployments serve a different purpose from production customer records. They must not be treated as unrestricted stores for real personal information, confidential cases, secrets or production exports.
Recipients, regions and safeguards
The applicable service schedule identifies the appointed legal provider, purpose, categories of data, relevant storage and support-access locations, authorised sub-processors and any required transfer mechanism or assessment. Confidential service processing must not begin on the assumption that a supplier’s general product description establishes these arrangements.
The use of OVHcloud object storage does not establish UK-only processing across USG. Contact privacy@universalsustainablegrowth.org for recipient, location and transfer information applicable to your data, including relevant safeguards and how to obtain them.
Provider approval and changes
The responsible service department, Operations Management and the Privacy and Compliance functions coordinate the approval of a provider for the particular purpose. The review addresses instructions, confidentiality, security, retention, deletion, international transfers, incident assistance, audit information and exit arrangements.
Material changes are reflected in the relevant notice or schedule, with customer authorisation, advance notice, an opportunity to object or fresh consent where required. Listing a technical function in this notice does not itself authorise a new customer sub-processor.
Security, retention and portability
Access should be limited to the relevant role and purpose. Retention and deletion consider database records, departmental email, stored files and backups separately. Export and recovery arrangements should preserve confidentiality and allow a controlled change of provider when required.
Public notices do not disclose credentials, server addresses, database endpoints, sensitive bucket details, private network topology or operational vulnerability information. See the Security & Access Control Policy for the public baseline.
Contact and review
Data handling and provider information: privacy@universalsustainablegrowth.org. Operational responsibility: office@universalsustainablegrowth.org. Formal complaints: complaints@universalsustainablegrowth.org.
See Operating Entity and Responsibilities and Complaints and Review.
Questions about this document?
Email the relevant address shown in this policy. Please do not send identity documents or confidential case material by ordinary email.