Eesti keeles: IV lisa
The controller authorises the following sub-processors (Clause 7.7(a)). All of them process the controller's data in the EU/EEA; Brevo's DPA permits transfers outside the EEA only under the EU standard contractual clauses.
| Sub-processor | Address | Processing | Location | Duration |
|---|---|---|---|---|
| Hetzner Online GmbH | Industriestr. 25, 91710 Gunzenhausen, Germany | Hosting of the production server: database, temporary encrypted audio storage, portal and processing pipeline | Falkenstein, Germany | Term of the Agreement |
| EUrouter B.V. (KVK 42054357) | Jacob van Lennepstraat 78H, 1053 HM Amsterdam, Netherlands | Gateway to AI language models: forwards transcript text to the model and returns the result; does not store prompts or outputs | Netherlands (infrastructure in Amsterdam) | Per request only |
| Microsoft Ireland Operations Limited, engaged by EUrouter | One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland | Runs the AI language models (Azure OpenAI in Microsoft Foundry) that analyse, pseudonymise and translate transcript text and write reports | EU Data Zone | Per request; Microsoft may keep prompts and outputs for up to 30 days solely for abuse monitoring, in the EU, unless an exemption applies |
| Sendinblue SAS (Brevo) | 9-17 rue Salneuve, 75017 Paris, France | Delivery of account e-mails, notifications, weekly notes and monthly reports to the controller's users | EU | Per message |
Not sub-processors: messaging services that the controller's users connect themselves for notifications (Telegram, Slack, Microsoft Teams, browser push) act on the controller's own instruction under the controller's agreements with those services. VILFF's own speech-recognition servers in Tallinn are part of VILFF's infrastructure, not a sub-processor.
VILFF informs customers of intended changes to this list by e-mail to the workspace owner and by updating this page at least 30 days in advance. A customer may object on reasonable data protection grounds within that period (DPA Clause 7.7(a) and Annex V, point 6).
This list is Annex IV of the Data Processing Agreement, version 1.2 of 16 October 2026.