List of Subprocessors
Last updated: September 2026
EFFIVIS TECHNOLOGIES S.L. ("Effivis") acts as Data Processor on behalf of its customers. To deliver the service it engages the subprocessors listed below, under the general authorisation provided for in Article 28.2 GDPR and clause 5 of the Data Processing Agreement (DPA) signed with each Customer.
This page is incorporated by reference into the DPA (clause 5 and Annex III). Its content forms part of the processing agreement and is kept up to date here.
1. Authorised subprocessors
| Subprocessor | Purpose | Processing location | Safeguards |
|---|---|---|---|
| Amazon Web Services EMEA S.à r.l. | Hosting, database, storage, OCR (Textract) and language models (Bedrock) | Ireland (eu-west-1) | AWS DPA + SCCs |
| Cloudflare, Inc. | DNS, CDN, WAF and DDoS protection | Global, with EU nodes | DPA + SCCs |
| OpenAI Ireland Ltd. | Embeddings and re-rank over pseudonymised content (AI features) | Ireland, with processing in the US | EU-US DPF + SCCs (Module 2) |
| Stripe Payments Europe Ltd. | Subscription billing and payment processing | Ireland, with processing in the US | Stripe DPA + SCCs |
| Google Ireland Ltd. | Vertex AI: the voice model that answers calls in real time, and language models (Madrid, europe-southwest1); Google Analytics 4 on the website; Drive / OAuth integrations | Ireland, with processing in the US | DPA + SCCs |
| DIDWW Ireland Ltd (VAT IE9712233V) | Voice carrier: numbering, SIP interconnection and termination of calls placed from the platform and the mobile app | Ireland (25 North Wall Quay, Dublin 1, D01 H104) | Processing within the EEA: no international transfer |
| Functional Software, Inc. (Sentry) | Error and performance monitoring of the web platform and the mobile app | EU ingestion and storage (de.sentry.io), US company | DPA + SCCs |
| 650 Industries, Inc. (Expo) | Delivery of push notifications for the iOS mobile app (gateway to Apple APNs) | United States | EU-US DPF |
SCCs = Standard Contractual Clauses approved by the European Commission (Decision 2021/914).
DPA = Data Processing Agreement (GDPR Art. 28).
EU-US DPF = EU-U.S. Data Privacy Framework (adequacy decision of 10 July 2023).
2. International transfers
Subprocessors located outside the European Economic Area process data under the European Commission's Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework adequacy decision, supplemented by encryption in transit (TLS 1.3) and at rest (AES-256) and by pseudonymisation wherever possible.
Expo (650 Industries, Inc.) is self-certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Framework, so the transfer relies on the European Commission's adequacy decision (Article 45 GDPR) and does not require Standard Contractual Clauses. The data transmitted to it is limited to the content of the notification itself and the device token: Expo does not retain the notification content, which it processes only for as long as it takes to deliver it. A user can prevent that transfer entirely by turning off the app's notifications in iOS settings.
3. Changes to the list and right to object
Under clause 5 of the DPA, Effivis will notify the Customer of any addition or replacement of a subprocessor at least 30 days in advance. During that period the Customer may object on reasonable data-protection grounds and, if the disagreement is not resolved, terminate the subscription without penalty.
To receive these notifications or request a copy of the safeguards applicable to any transfer, email [email protected].
4. Contact
EFFIVIS TECHNOLOGIES S.L.
C/ Zurbano 49, Bajo – Oficina 4
28010 Madrid, Spain
Privacy: [email protected]
See also our Privacy Policy and Terms of Service.