Contact: privacy@atmoz.io
Atmoz AB (corp. reg. 559345-4001) is the data processor for customer data in the Atmoz platform; the customer is the data controller. This list covers that data only.
We engage the sub-processors below to deliver the service. We give at least 30 days' advance notice before adding or replacing a sub-processor, and customers may object on reasonable data-protection grounds.
This list is maintained to name every provider that processes customer personal data on our behalf today. Where we have contracted a provider that is not yet connected to the platform and receives no customer data, it is not listed here - and it will be added to this list, with its location and safeguards, before it receives any.
All customer data is stored within the EU/EEA. Sub-processors with global operations may access data from outside the EU/EEA for support, engineering, on-call or incident response; where that arises, the safeguards marked against that sub-processor apply.
C.1 Infrastructure and platform
| Sub-processor | Legal entity | Purpose | Personal data | Processing location | Transfer mechanism |
|---|---|---|---|---|---|
| Google Cloud Platform | Google Cloud EMEA Ltd / Google LLC | Compute, storage, database, networking, logging | Personal data stored in the platform (Appendix A.6), including account records, application and access logs with end-user IP addresses, and source documents | EU | EU processing; Google Cloud DPA and its Standard Contractual Clauses. Google LLC is EU-U.S. DPF certified |
| Snowflake | Snowflake Inc. | Data warehouse | Data extracted from source documents and ERP data, including the contact details and other personal data they contain (Appendix A.6(b)) | Google Cloud europe-west3 (Frankfurt) |
EU processing; DPA and Standard Contractual Clauses. Snowflake Inc. is EU-U.S. DPF certified for non-HR data |
| Zitadel Cloud | CAOS AG, CH-9014 St. Gallen, Switzerland (parent company ZITADEL Inc., San Francisco) | Identity and access management, authentication | Name, email address, role, login metadata, end-user IP addresses in authentication logs (see Appendix B.4) | Instance in EU region europe-west3 (Frankfurt) | The contracting entity is Swiss and covered by the European Commission’s adequacy decision for Switzerland. Support access from outside the EU/EEA and Switzerland runs under the vendor’s Standard Contractual Clauses, Module Two, confirmed by the vendor in writing |
| Scaleway TEM | Scaleway SAS, R.C.S. Paris 433 115 904, 8 rue de la Ville l’Evêque, 75008 Paris, France | Transactional email – user invitations, identity email, and supplier requests sent through the platform (clause 6.9) | Recipient email address, message content | fr-par (Paris) – region selected by Atmoz. The provider has confirmed in writing that processing, storage and personnel remain within the EU/EEA |
EU processing; French entity. No transfer outside the EU/EEA; the provider engages no sub-processors for this product |
| Grafana Cloud | Raintank Inc. dba Grafana Labs, USA | Observability – metrics, traces and logs from the platform’s services | End-user IP addresses in application request logs; service telemetry | EU Sweden, AWS eu-north-1 |
Pre-signed DPA; Standard Contractual Clauses. Raintank Inc. dba Grafana Labs is EU-U.S. DPF self-certified |
| Sentry | Functional Software, Inc. | Error monitoring | Error events, designed to contain no personal data or other Controller data (Appendix A.7) | EU (Frankfurt) | DPA; DPF; SCC, Module Three, where the Framework does not apply |
| Amplitude | Amplitude, Inc., USA | Product analytics (clause 6.7) | Usage Data: a pseudonymous user identifier and predefined interaction events. No names, email addresses, IP addresses or Controller Content (Appendix A.7) | EU data centre (AWS, Frankfurt). Processing begins only when product analytics is enabled | DPA; DPF; SCC, Module Three, where the Framework does not apply |
C.2 AI and LLM inference
| Sub-processor | Legal entity | Purpose | Personal data | Processing location | Transfer mechanism |
|---|---|---|---|---|---|
| Google Vertex AI | Google Cloud EMEA Ltd / Google LLC | Hosting platform for LLM inference – document parsing, classification, supplier resolution | Any personal data incidentally present in source documents | EU multi-region (eu) in production |
EU processing; Google Cloud DPA. Google LLC is EU-U.S. DPF certified |
Vertex AI serves the language models Atmoz uses, including Anthropic’s Claude models, within Google’s infrastructure under the Google Cloud DPA. Atmoz has no contract or data flow with any model developer, so model developers are not sub-processors of Atmoz. The no-training and retention position for this processing is in clause 6.5.
C.3 Company registries – recipients, and the role each holds
The enrichment service looks up a supplier’s industry classification so that an emission factor can be selected. It sends company identifiers only – name, VAT number, organisation number and country code – and no contact details. For a sole trader, a company name and registration number may identify an individual, which is why these lookups are treated as personal-data processing.
None of these recipients is an Article 28 sub-processor: each decides its own purposes for its register and is an independent controller.
| Recipient | Legal entity | Role | Data sent | Location | Transfer mechanism |
|---|---|---|---|---|---|
| Bolagsverket (Swedish Companies Registration Office) | Bolagsverket, Sweden | Independent controller – statutory public register | Organisation or VAT number only | Sweden – EEA | None required – intra-EEA |
| Erhvervsstyrelsen (Danish Business Authority) | Erhvervsstyrelsen, Denmark | Independent controller – statutory public register | CVR number, or supplier name | Denmark – EEA | None required – intra-EEA |
| Brønnøysundregistrene (Norwegian Register Centre) | Brønnøysundregistrene, Norway | Independent controller – statutory public register | Organisation number, or supplier name | Norway – EEA | None required – intra-EEA |
| Dun & Bradstreet (Direct+) | Bisnode Dun & Bradstreet Sverige Aktiebolag | Independent controller – commercial business-information register | VAT number where present, otherwise organisation number; or name and country; or name alone | EU | DPA · SCCs · DPF |
The Dun & Bradstreet lookup is made only where the national registers do not resolve the supplier.
C.4 Further parties engaged by Atmoz’s sub-processors
Atmoz’s sub-processors engage further parties of their own. Atmoz maintains a record of those in Atmoz’s data path, recording for each the engaging sub-processor, the purpose, the location and whether the party receives Controller data.
That record is provided to the Controller on request.
Questions, or details of our sub-processors' own sub-processors: privacy@atmoz.io