Sub-processors
This is an English translation for convenience. The Czech version is legally binding; in case of any discrepancy, the Czech version prevails. Česká verze
This list is Annex 3 to the Data Processing Agreement. It contains all third parties that may gain access to customers’ data in the course of running the service. The list is short on purpose — the fewer parties, the fewer places where something can go wrong.
We announce changes 30 days in advance. If we add or replace a sub-processor, we will let customers know by e-mail at least 30 days in advance. The customer may raise a reasoned objection; if we do not resolve it within 30 days, the customer may terminate the contract as of the day on which the change is to take effect.
Sub-processors involved in running the service
| Sub-processor | What it does for us | What data it can access | Where the data is |
|---|---|---|---|
| Hetzner Online GmbH Germany | rental of a virtual server in a data centre on which the service and the database run | all data stored on the server — as the operator of the infrastructure, not as a user of the system | European Union — Hetzner nbg1-dc3, Nuremberg, Germany |
| Cloudflare, Inc. USA · mode: DNS only | domain management and domain name resolution (DNS) | none — in “DNS only” mode traffic goes directly to our server and Cloudflare does not see the content; it is not a processor of personal data | it does not retain data from the system; see the explanation below the table |
| Google Ireland Limited (Google Workspace), Ireland | outgoing mail server (SMTP) — the system uses it to send billing statements and reminders and the mail that the customer writes in its own name from the Mail module | addresses of all recipients, subject, the entire body of the message and attachments; for the customer’s mail also the customer’s sender address | European Union (Ireland); transfer outside the EEA, in particular to the USA, is possible and is safeguarded by the adequacy decision under the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) and by standard contractual clauses (Commission Implementing Decision (EU) 2021/914) |
Processor engaged only in AI automations
This processing applies only to customers who have ordered an AI automation (Article 10 of the Terms and Conditions). The Evikom application itself does not use artificial intelligence to work with customers’ data; nothing is passed on from the application for other customers. Outside the application (communication with prospects and customers) we use the same provider when preparing replies — see “Services outside the system”. By ordering an AI automation the customer agrees to this processor; for existing customers without an AI automation nothing changes.
| Processor | What it does for us | What data it gets | Where the data is |
|---|---|---|---|
| Anthropic, PBC USA | provider of the artificial intelligence model (Claude API) that reads and processes the materials in an AI automation | only what the automation processes — the text and attachments of documents or messages (for example the supplier, amounts, names and contacts stated in a document). Nothing the automation does not process. | outside the EU, usually the USA; the transfer is safeguarded by standard contractual clauses (Commission Implementing Decision (EU) 2021/914) contained in the provider’s data processing addendum. Under the provider’s data processing addendum, data is processed to provide the service and is deleted within 30 days after the contract ends; the provider does not use API data to train its models. We monitor changes to its other processors and will announce them without undue delay. |
Note on Cloudflare’s role
We distinguish two modes and there is a material difference between them:
- DNS only. Cloudflare merely tells the browser at what address the server is located. Traffic goes directly to our server and Cloudflare does not gain access to the content or to customers’ data. In this mode it is not a processor of personal data in the system.
- Reverse proxy. Traffic flows through Cloudflare, which decrypts and re-encrypts it. In this mode all communication, including logins, passes through its servers and Cloudflare is a processor; the condition is a concluded data processing agreement and securing any transfer outside the European Union by one of the tools under Chapter V GDPR.
The mode currently in use is stated in the table above.
Services outside the system
The following services do not gain access to the customer’s data in the system. We list them for completeness, because other personal data arises in them, which is described in the Privacy Policy.
| Service | Used for | What it concerns |
|---|---|---|
| Mobile notification of a new message from the contact form (ntfy) | alerting our team that a message has arrived | the notification contains only the message number, no personal data — the notification provider is therefore not a recipient of personal data |
| Google Forms (Google Ireland Limited) | questionnaire for those interested in the service | only the answers of people who fill in the questionnaire themselves (legal basis: our legitimate interest in preparing an offer, see the privacy policy); it has nothing to do with the system |
| Anthropic, PBC (USA) | artificial intelligence tool with which we process the text of a prospect’s or customer’s message when preparing a reply; a person always approves the reply | the text of the message the prospect or customer wrote to us; the transfer is safeguarded by standard contractual clauses; it does not reach data inside the system |
| Google Workspace (Google Ireland Limited, Ireland) | the provider’s e-mail mailbox — incoming mail to podpora@pridom.cz, the archive of sent messages and any e-mail notification of a new message from the contact form | ordinary business and support communication with the customer’s contact persons; it has no access to the data inside the system. The same provider is also the system’s outgoing mail server — in that role it is listed in the table above. |
What is not on the list and will not be without notice
- No analytics, advertising or marketing tools.
- No service for tracking user behaviour.
- No artificial intelligence provider to which the data of customers who have not ordered an AI automation would be sent from the application. For an ordered AI automation it is Anthropic, PBC (see above); the same provider processes the text of a prospect’s or customer’s message when preparing our reply (see “Services outside the system”).
- No sharing of data between customers or merging them into common overviews.
- No payment gateway provider — payments are made by bank transfer, we do not accept cards.
Questions about this list: podpora@pridom.cz