Sub-processors

Template. Written for the EU GDPR, the Digital Services Act and the Data Act, and the New Zealand Privacy Act 2020. Fill in your company details in the server settings and have a lawyer review it before launch. Last updated: [date].

These providers process personal data on our behalf. We tell customers at least 30 days before adding or replacing one (see the data processing agreement).

Provider	Purpose	Data	Location and safeguard
[hosting provider]	Servers, storage and backups	All service data (encrypted at rest)	[EU region]
[email provider]	Sending service emails	Recipient address, email content (invitations, minutes, notices)	[location; SCCs if outside the EU]
Stripe Payments Europe Ltd	Payments and invoices	Billing contact, billing address, VAT number, payment details (card data never reaches us)	Ireland; transfers to Stripe, Inc. (US) under the EU–US Data Privacy Framework and SCCs
Anthropic PBC (only if your organisation turns on AI drafting)	Generating AI drafts	Section text and project details sent with a draft request	United States; Standard Contractual Clauses; API data not used for model training

Not sub-processors: virus scanning runs on our own servers when enabled; the list of funding calls is downloaded from the European Commission’s public Funding & Tenders Portal without sending any customer data.