SUB-PROCESSORS

Who else processes personal data when you use Atom9.

This is the list the DPA clause 3.1 refers to. It is not written by hand: it is composed from the configuration of the deployment serving this page, so a party appears here because this system is configured to send data to it, and disappears when it no longer is.

How to read this list

Each row names the party, what it is used for, and the personal data that actually reaches it. Outside the EU/EEA means exactly that: when the feature in that row is used, personal data leaves the EEA. Transfers outside the EEA are covered by DPA 5.1. Where a row says not determined, this deployment's configuration does not record where that party processes data — treat it as outside the EU/EEA until it says otherwise.

SUB 1

Third parties engaged by this deployment.

Hetzner Online GmbHInside the EU/EEA Infrastructure hosting — Servers, databases and backups that run the platform.
Personal data reaching them: All personal data the platform stores for a customer.
Processing location: Nuremberg, Germany.

AxForgeInside the EU/EEA AI model inference — Answers in the built-in assistant, and the agents a workspace runs.
Personal data reaching them: The whole conversation: messages, the page context, uploaded file paths and tool results.
Processing location: Sweden.
Engaged when someone uses the assistant or an AI agent.

DuckDuckGoOutside the EU/EEA Web search — Looks up public sources when a user asks the assistant to research.
Personal data reaching them: The search query the user typed.
Processing location: United States.
Engaged only when a user runs a research request.

Not identified (mailcluster.loopia.se)Not determined from configuration Transactional email — Delivers verification codes, magic links, password resets and notices.
Personal data reaching them: Recipient email address, the message, and delivery metadata.
Processing location: not recorded in this deployment's configuration.

SUB 2

Handled on infrastructure Atom9 operates.

Nothing in this groupEvery configured processing path in this deployment involves a party listed above.

SUB 3

Changes, notice, and what this list does not cover.

3.1 Changes

Adding or replacing a sub-processor changes this page, because the page is generated from the configuration that makes the change. Notice of an intended addition or replacement, and the right to object on reasonable data-protection grounds, are covered by DPA 3.2.

3.2 What is not on this list

Services a customer connects itself — an external system wired up through Connectors, an AI provider a workspace configures with its own credentials, or a social-login provider a customer enables for its own end-users — are the customer's own sub-processors. They are chosen per workspace, so they are visible in the workspace that configured them and named in that workspace's own sub-processor annex, not here.

3.3 Questions and copies

Questions about a party on this list, or a request for a countersigned DPA naming it, go through the data request form (see Contact & legal information).