To provide the Slimaco AI service, we use providers to whom we entrust the processing of Customers’ personal data (sub-processors). They are listed below. We impose data protection obligations on each sub-processor in our agreement with them, consistent with the data processing agreement with the Customer.
| Sub-processor | Purpose | Location | Basis for transfer outside the EEA |
|---|---|---|---|
| Google Cloud | Platform hosting, databases, file storage, backups | EU: Poland (production database), backups in the EU, Belgium (disk snapshots), the Netherlands (computing) | Not applicable to storage in the EU. For any access from outside the EU: standard contractual clauses or the EU-US Data Privacy Framework, as provided in the agreement with the provider |
| Microsoft Azure (Azure OpenAI, Azure AI Foundry) | Language models | EU data zone (Poland, Sweden, France); selected models in global mode (also outside the EU) | For models in global mode: standard contractual clauses or a European Commission decision (EU-US Data Privacy Framework), as provided in the agreement with the provider |
| Anthropic (Claude models via Microsoft Azure AI Foundry) | Language models — only if the company enables global models | Global, including the USA; one of the versions runs outside Azure infrastructure | Standard contractual clauses or a European Commission decision (EU-US Data Privacy Framework), as provided in the agreement with the provider |
| Composio (Sampark Inc) | Integrations with the Customer’s accounts (mail, calendar, drive, CRM) | USA | Standard contractual clauses |
| Postmark | Platform notifications | USA | Standard contractual clauses or a European Commission decision (EU-US Data Privacy Framework), as provided in the agreement with the provider |
| Brave Software (Brave Search) | Web search (optional feature) — a query containing a recognised personal identifier is not sent | USA | Standard contractual clauses |
Apart from this list, parts of the platform run on our own infrastructure (sign-in, event queues, vector database, embedding model, request tracing, model gateway). These are not separate sub-processors.
Signing in with a Google or Microsoft account is optional and based on the user’s decision. These providers process sign-in data on their own behalf.
The providers of slimaco.com website tools (contact form, analytics) are described in the Privacy Policy and the Cookie Policy.
Changes to the list
We inform Customers by e-mail 14 days before adding or replacing a sub-processor. The Customer may object in the manner set out in the data processing agreement.
Contact
This English version is a translation of the Polish original. In case of any discrepancy, the Polish version governs.