ANNEX 5 – Subprocessors
| Vendor | Purpose | Data location (EU/EEA) |
|---|---|---|
| Clerk | Authentication & identity | Germany |
| Vercel | Hosting / edge | Sweden and France |
| AWS | Cloud infrastructure | Sweden |
| MongoDB Atlas | Managed database | Sweden |
| Microsoft Azure | Cloud services | Sweden |
| Pipedrive | CRM & sales tools | Europe (AWS) |
Supplier will provide at least 30 days' prior notice of changes. The data controller (i.e., the customer) has the right to object to the notified change on reasonable grounds, such as insufficient data security with the new subprocessor.