Sub-processors — Attestia.eu

The Polish version is legally binding. In case of any discrepancy between the Polish and English versions, the Polish version shall prevail. The English version is provided for information.

Version: 1.0 Effective date: 2026-04-22 Last updated: 2026-04-22 Related documents:

• Terms § 10 + Annex 1 (DPA) — attestia.eu/terms
• Privacy Policy section 6 — attestia.eu/privacy
• Security — attestia.eu/security

1. What is the sub-processor list

Pursuant to Art. 28(2) and (4) GDPR and Art. 5 of the DPA (Annex 1 to the Terms), Attestia — as a processor — provides Organisations (controllers) with the current list of further processors ("sub-processors") engaged in connection with delivery of the Platform.

This page is the sole binding source of the current sub-processor list. In case of discrepancy between this list and copies published elsewhere (Privacy Policy, Terms), this page prevails — noting that the Terms and Privacy Policy are updated in parallel.

Capitalised terms have the meaning given in the Terms.

2. Current sub-processor list

Active sub-processors: 5.

3. Optional external authentication tools

The tools below are engaged only if the User chooses to use them at registration or login (alternative to email + password). If the User uses only email + password, their data is not shared with these providers.

Data scope: OAuth identifier, email address (only to the extent necessary for Account identification). Scope limited to email + profile.

4. Change notification process

Under Art. 5 of the DPA (Annex 1 to the Terms):

1. Notice period: Attestia will notify Organisations of any intended addition or replacement of a sub-processor with at least 30 days' notice before the planned change.

2. Notification channels:

   • via email to the Account Owner,
   • via in-app notification,
   • via update to this page (with publication date).

3. Right to object:

   • An Organisation with reasonable objections may object within 30 days of receipt of the notification.
   • The parties negotiate a solution.
   • If no solution is reached within 30 days of the objection, the Organisation has the right to terminate the contract with immediate effect, with a proportional refund of the fee for the unused Billing Period.

4. Form of objection: email to privacy@attestia.eu with subject [OBJECTION: SUB-PROCESSOR] and justification.

5. Obligations on new sub-processors: Attestia ensures that every new sub-processor is bound by the same data-protection obligations as those in the DPA (Annex 1 to the Terms) — in particular Art. 28(3) GDPR obligations and Annex A (Technical and Organisational Measures).

5. Transfers outside the EEA

Attestia does NOT transfer outside the EEA:

• Organisation Data (AI System descriptions, questionnaire answers, evidence files),
• generated Compliance Documents,
• data processed by Azure OpenAI (Sweden Central region, within the EU).

6. Recipients who are not sub-processors

The following entities may receive data in a defined scope but are not sub-processors within the meaning of Art. 28 GDPR:

7. Sub-processor vetting procedure

Every new sub-processor, before being added to the list, is assessed for:

1. GDPR compliance — execution of a DPA with Attestia compliant with Art. 28 GDPR, including an Annex on technical and organisational measures (Art. 32 GDPR).
2. Data location — preference for EU/EEA regions; transfers outside the EEA only with an adequate mechanism (SCC / DPF / adequacy decision).
3. Security — certifications (ISO 27001, SOC 2), incident history, security posture.
4. Financial stability — minimising supply-chain risk arising from bankruptcy/withdrawal.
5. Interoperability — ability to migrate to an alternative provider without loss of compliance functionality.

Assessment results are documented in an internal Attestia register.

8. Changelog

Historical versions are archived and available on request to privacy@attestia.eu.

9. Notification subscription

Organisations receive change notifications automatically at the Account Owner's email. Additionally, any interested person (e.g. customer DPO, compliance officer) may subscribe to a dedicated notification channel by sending a request to privacy@attestia.eu with subject [SUBPROCESSOR UPDATES SUBSCRIPTION].

10. Contact