Hetzner Online GmbH ("Hetzner") | Registration Court Ansbach, HRB 6089
VAT ID No. DE 812871812 | Industriestr. 25
91710 Gunzenhausen
Germany | Hetzner is used for the operation of the Vendortell Platform, including compute and application hosting, database operation, block storage and object storage. Data in the platform, including any personal data, is therefore processed and stored by Hetzner as sub-processor.
Data is encrypted in transit and at rest, and is processed and stored within the EU/EEA without transfer to third countries or international organisations.
Personal data is processed under Hetzner’s standard data processing agreement. A copy of the data processing agreement with Hetzner can be shared with the data controller on request. |
Amazon Web Services EMEA SARL ("AWS") | R.C.S. Luxembourg B 186284
VAT ID No. LU 26888617 | 38 Avenue John F. Kennedy
L-1855 Luxembourg
Luxembourg | AWS is used for optical character recognition (OCR) of documents uploaded by the data controller, and for the operation of parts of the platform’s supporting infrastructure, including storage of customer data. Documents, including any personal data contained in them, are therefore processed by AWS as sub-processor. It is noted that data is not used to train any models.
Data is encrypted in transit and at rest, and is processed and stored within the EU/EEA. Eu-central-1 (Frankfurt) region is chosen as the primary selected data location.
Under AWS’s standard data processing addendum, AWS may access customer content from outside the EEA for the purpose of providing support and operating the services. Such access takes place on the basis of the EU standard contractual clauses incorporated into that addendum, together with the supplementary technical, organisational and contractual measures described therein.
A copy of the data processing agreement with AWS can be shared with the data controller on request.
The data processor is in the process of transferring the services currently provided by AWS to the other sub-processors listed in this Appendix B.1. Completion is expected by the end of 2026, after which AWS will no longer be used for any services involving the processing of customer data, and AWS will be removed from this Appendix. |
Microsoft Ireland Operations Limited ("Microsoft") | Company ID 256796 | One Microsoft Place
South County Business Park
Leopardstown
Dublin 18, D18 P521
Ireland Invoiced by Microsoft Danmark ApS | The data controller makes use of the data processor’s AI functionality (Azure OpenAI Services (API)) in the platform. Microsoft’s large language models are used to analyse, extract and summarise contract and vendor information, and any personal data contained in the documentation submitted is therefore processed by Microsoft in that connection.
The service is a stateless API service, and customer data is therefore not stored permanently by Microsoft as part of the data processor’s use of the service, noting that prompt snippets may be retained for abuse-monitoring purposes. Customer data is not used to train Microsoft’s models.
The data processor uses a DataZone deployment model with Sweden Central as the primary selected data location. Azure OpenAI Service is furthermore configured as an EU Data Boundary Service (EU data zone), and processing may accordingly take place in any EU/EEA member state but never outside the EU/EEA.
Microsoft’s processing is governed by a data processing agreement, a copy of which can be shared with the data controller on request. |
Mistral AI SAS ("Mistral") | R.C.S. Paris 952 418 325 | 15 rue des Halles
75001 Paris
France | Mistral is used for optical character recognition of documents uploaded by the data controller. Any personal data contained in those documents is therefore processed by Mistral in that connection.
Customer data is not retained by Mistral beyond the completion of the processing, and is not used to train Mistral’s models.
Data is processed within the EU/EEA without transfer to third countries or international organisations.
A copy of the data processing agreement with Mistral can be shared with the data controller on request. |