Google Workspace
Used for organisational email, account administration and controlled document storage. The final register must record the relevant service terms, administrator roles, retention, security configuration and international-transfer position.
Google Apps Script
Used to deliver the live CV Builder. The data-flow map and DPIA must document what information moves through the application, where it is stored, who can access it and how deletion is enforced.
Resend
Used for operational CV Builder emails, including finished CV delivery and secure return links. Messages are sent from the verified mail.thehwbco.com sending domain. API credentials remain in the server-side Apps Script configuration and are not included in the public website files. Supplier terms, processing role, security, retention and international-transfer details remain part of the documented supplier review.
Square
Used for donations and the optional £5 custom CV payment. The payment relationship, privacy role and information exchanged must be documented accurately. The static website does not process card information itself.
IONOS
Used for the domain, static website infrastructure and SiteAnalytics. IONOS states that SiteAnalytics does not use cookies, anonymises IP addresses directly after transmission and produces statistics for website evaluation and technical optimisation. Hosting access is restricted and Google Workspace DNS records are managed separately from website content.
The website links to The Hwb Collective’s Instagram profile. The homepage previews use copies of images hosted on this website; no Instagram plugin, tracking pixel or live social feed loads automatically. A visitor contacts Meta only after choosing to follow an external Instagram link, where Meta’s own terms and privacy information apply.
Website analytics and media
IONOS SiteAnalytics is the only website measurement service currently declared. The website does not use Google Analytics, Meta Pixel, advertising technology, heatmaps, session recordings or automatically loaded third-party media. Any future service must be entered in the supplier register and assessed before it is enabled.
Supplier status
This page identifies known services but is not a completed Article 30 record or supplier due-diligence file. Contract role, data location, transfer mechanism, retention, security evidence and termination arrangements remain part of the internal assurance process.