Annex C Authorized subprocessors
Terms and Notices — Sellforte Solutions Oy — 2026-09
EU/rest of the world (excluding the US). The contracting entity in the Order Form determines the applicable terms.
Annex C Authorized subprocessors
The Customer authorizes the following subprocessors for the stated functions when used to deliver its Services. The primary hosting region follows the Order Form. A hosting region does not confine all supplier activity to that region: suppliers and their authorized subprocessors may access or process data in other countries for support and related service operations, subject to DPA Section 13 (International transfers) and Annex D. Additions or replacements follow DPA Section 7.2 (List and changes).
|
Entity |
Function |
Location and use |
|---|---|---|
|
Amazon Web Services EMEA SARL |
Hosting, backups and Bedrock inference |
EU, ordinarily Ireland, by default. Another supported primary region may be selected in the Order Form. International support and related processing follow the safeguards above. |
|
Google Cloud EMEA Limited |
Alternative hosting and infrastructure |
Alternative cloud provider. EU primary hosting by default; another supported region if selected in the Order Form. International support and related processing follow the safeguards above. |
|
Fivetran Inc. |
Data connectors and ingestion |
EU processing region by default; another supported region if selected in the Order Form. International support and related processing follow the safeguards above. |
|
Microsoft Ireland Operations Limited |
Microsoft 365 communications and collaboration |
Microsoft 365 communications and support content under EU data-residency arrangements. International support and related processing follow the safeguards above. |
|
HubSpot Ireland Limited |
Support and ticket management |
EU hosting. International support and related processing follow the safeguards above. |
|
Sellforte, Inc. |
Authorized engineering, support or service delivery |
United States. Remote support and delivery access to Oy's EEA-hosted environments under the intragroup DPA and EU SCCs, Module Three. Oy Customer Personal Data must not be downloaded, copied locally, or retained by Inc beyond the access session. |
|
Sellforte Solutions GmbH |
Authorized engineering, support, or service delivery |
Germany. Authorized support, engineering, and service delivery. |
|
Sellforte Solutions UK Ltd |
Authorized support or service delivery |
United Kingdom. Support and service delivery under intragroup processing terms. Covered EU-to-UK transfers rely on a valid EU adequacy decision. |
|
OpenAI Ireland Ltd. |
ChatGPT Business for scoped drafting, analysis, troubleshooting, and service support where Customer Personal Data is submitted. |
Processing may occur in the United States and other countries in the applicable supplier register. EU-only residency is not promised for this business subscription. No model training on Customer Personal Data; applicable deletion and safety-retention terms and DPA safeguards apply. |
|
Anthropic Ireland, Limited |
Claude Team for scoped drafting, analysis, troubleshooting, and service support where Customer Personal Data is submitted. This direct use is separate from Bedrock inference. |
Processing may occur in the United States and other supported locations in the supplier arrangements. EU-only residency is not promised. No model training on Customer Personal Data; stored chats, deletion, and applicable safety-retention terms remain relevant. |
|
Notion Labs, Inc. |
Customer delivery documentation, collaboration, and enabled AI assistance or meeting notes where Customer Personal Data is submitted. |
United States and applicable downstream processing locations. Non-Enterprise AI processing is not represented as zero retention or EU-only. Pages, attachments, recordings, transcripts, summaries, and AI-provider copies have distinct deletion requirements. |
The listed Affiliates are authorized for these functions whether or not currently involved in a particular Customer's service delivery. Sellforte remains responsible for their performance and ensures binding confidentiality, processing, and transfer safeguards before access. Changes to recipients or processing beyond this authorization follow DPA Section 7.2 (List and changes). Sellforte will proactively provide the Customer with up-to-date identity, address, and contact information for the relevant processors and downstream subprocessors, together with their functions and processing countries, through a customer-accessible register or direct communication. Providing information does not itself authorize additional subprocessors or waive the DPA's notice and objection requirements.