(Annex III to the Data Processing Agreement)
This Annex forms part of the Data Processing Agreement between SantaClues AS (Processor) and the Controller.
It identifies subprocessors engaged by SantaClues in connection with the provision of the Services.
SantaClues may update this list in accordance with Section 7 of the Data Processing Agreement.
1. Subprocessor List
| Subprocessor |
Service Function |
Processing Location |
Personal Data Processed |
Transfer Mechanism |
| DigitalOcean LLC |
Cloud infrastructure hosting, managed PostgreSQL database, Redis cache, object storage (Spaces) |
EU and global infrastructure regions |
Transcripts, application data, metadata, exports |
SCCs where required |
| Soniox Inc. |
Speech-to-text transcription services |
Global infrastructure |
Audio streams, transcript content |
SCCs |
| OpenAI, L.L.C. |
Speech-to-text and large language model processing |
United States / global infrastructure |
Transcript content, prompt inputs and outputs |
SCCs |
| Groq Inc. |
LLM inference infrastructure |
United States |
Transcript content, prompt inputs and outputs |
SCCs |
| xAI Corp. |
LLM inference services |
United States |
Transcript content, prompt inputs and outputs |
SCCs |
| Stripe, Inc. |
Payment processing and billing infrastructure |
United States / global infrastructure |
Customer billing data, account identifiers |
SCCs |
| SendGrid, Inc. (Twilio) |
Transactional email delivery |
United States |
Account email addresses and notification data |
SCCs |
| Google LLC |
Authentication, analytics, and infrastructure services where used by the platform |
United States / global infrastructure |
Account metadata and operational telemetry |
SCCs |
| Meta Platforms, Inc. |
Authentication or integration services where enabled by the Controller |
United States / global infrastructure |
Account identifiers where such integrations are used |
SCCs |
| Apple Inc. |
Platform authentication and device services where applicable |
United States / global infrastructure |
Account identifiers where such integrations are used |
SCCs |
| Microsoft Corporation |
Authentication and platform services where applicable |
United States / global infrastructure |
Account identifiers where such integrations are used |
SCCs |
2. Categories of Subprocessing
Subprocessors are used for the following operational functions:
Infrastructure
- Cloud hosting
- Database services
- Object storage
- Caching infrastructure
Core Processing
- Speech-to-text transcription
- LLM-based transcript analysis
Operational Services
- Payment processing
- Transactional email delivery
Platform Integrations
- Authentication providers
- Device ecosystem integrations
Subprocessors may process transcript content, audio data, account data, or operational metadata, depending on the specific service function.
3. International Transfers
Certain subprocessors operate infrastructure outside the European Economic Area.
Where personal data is transferred to a third country that is not subject to an adequacy decision, SantaClues relies on:
- Standard Contractual Clauses (SCCs); and
- Transfer Impact Assessments (TIAs)
as described in the Data Processing Agreement.
EU-only processing is not guaranteed by system architecture.
4. Subprocessor Updates
SantaClues may update this list in accordance with the DPA.
Controllers will be notified of intended additions or replacements at least 30 days in advance, after which Controllers may object on reasonable data protection grounds.