Subcontractors

Currently, the following subcontractors are used by branchly:

Microsoft -  Infrastructure and hosting (MS Azure; DPF-certified)

Microsoft Ireland Operations Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland

Place of processing: EU data centers Frankfurt (Germany West Central), Amsterdam (Europe West), and Gävle/Sandviken (Sweden Central). Third country transfer: No; Microsoft is additionally certified under the EU-U.S. Data Privacy Framework (DPF).

Processed data: Object storage, backups, databases, AI models.

EU Data Protection Officer: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland, Phone: +353 (1) 706-3117

Web form at: https://aka.ms/privacyresponse

The contact details of the Data Protection Officer have been communicated to Microsoft's supervisory authority.

Clerk Inc. - Management of user accounts for customer employees

Clerk Inc., 660 King Street Unit 203, San Francisco, CA 94107, USA

Place of processing: USA. Third country transfer: Yes, based on the EU Standard Contractual Clauses (SCCs) pursuant to Regulation (EU) 2016/679.

Processed data: Account data of customer employees (including names, email addresses, access credentials, roles).

EU Data Protection Officer: Osano International Compliance Services Limited, ATTN: XTG6, 25/28 North Wall Quay, Dublin 1, D01 H104, Ireland

Email contact: support@clerk.dev

Cloudflare - Provision of static content (CDN)

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA

Place of processing: USA and global edge network (solely for the delivery of static content). Third country transfer: Yes, based on the EU-U.S. Data Privacy Framework (DPF). Cloudflare, Inc. is DPF-certified.

Processed data: IP addresses and technical request metadata (transient, solely for the delivery of static content).

EU Data Protection Officer: Cloudflare GmbH, Rosental 7, 80331 Munich, Attention: Data Protection Officer

Email contact: dpo@cloudflare.com

OVH Cloud - Infrastructure, databases, and AI models

OVH GmbH, Christophstraße 19, 50670 Cologne

Place of processing: Data center Frankfurt am Main/Limburg, Germany. Third country transfer: No.

Processed data: Platform and application data during the operation of infrastructure, databases (including conversations and session data), and AI models.

EU Data Protection Officer: OVH SAS, Data Protection Officer, 2 rue Kellermann, 59100 Roubaix, France

Google Cloud EMEA Limited — Provision of cloud infrastructure and AI models (optional)

Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland

Place of processing & third country transfer: Exclusively EU/EEA. The execution of AI models and data processing take place strictly in European regions. Any technically or operationally required access by the US parent company (Google LLC, e.g., for global support or infrastructure maintenance) is secured by the EU-U.S. Data Privacy Framework (DPF) and EU Standard Contractual Clauses (SCCs).

Processed data: Search queries and knowledge content for the execution of AI models.

EU Data Protection Officer: Google Cloud Privacy Team / Data Protection Officer, Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland

Email contact: data-protection-office@google.com

Changes to the subcontractors used will be communicated to customers in good time in advance. This list is updated on an ongoing basis.