--- version: "1.2" effective_from: "2026-08-07" title: "Sub-processors and Recipients" document_url: "/legal/sub-processors/1.2.md" --- # Sub-processors and Recipients **Version 1.2 — Effective 7 August 2026** Controller: EgoVista SAS, 47 rue Vivienne, 75002 Paris, France — SIREN 106 489 735 --- ## 1. Purpose, scope and relation to our other documents This document lists the suppliers to which EgoVista SAS entrusts the processing of personal data, together with the recipients acting as controllers in their own right. For each of them it states the contracting entity, the purpose, the categories of data concerned, the place of processing, and the basis on which any transfer outside the European Economic Area takes place. It is the single source on the identity of suppliers and on transfer bases. Identifiers and versions of technical components live in the technical annex. Retention periods live in the retention and deletion policy. The purposes and legal bases of each processing operation live in the privacy policy and in the record of processing activities. Those documents reference this one and do not restate its content. **It describes a state of affairs observed on 7 August 2026.** Where a contractual arrangement is incomplete, this document says so on the line concerned rather than omitting it. A gap that is written down is a statement of fact; a gap that is passed over in silence is not. This is the public version of an internal document. The internal version additionally contains an analysis of clauses common to the contracts examined, a review of account ownership and authentication, and the open points being resolved. Those sections concern the internal conduct of the company and are not reproduced here. Section numbering in this public version is continuous and does not follow the internal numbering. ## 2. Version history **Version 1.0, 3 August 2026.** Nine suppliers. Carried the statement "not applicable, processing within the Union" on five lines. Internal version, not published. **Version 1.1, 3 August 2026.** Eleven suppliers. Full correction of the transfer bases and introduction of the typology of four regimes described in section 3. Addition of Upstash, Inc. and Microsoft Ireland Operations Limited. **Version 1.2, 7 August 2026.** Eleven suppliers, unchanged. The labelling path switchover is complete: the line concerning the label generation supplier no longer describes a secondary path undergoing alignment, and that item is removed from the review scheduled for 31 August. The consequence of regime C stated in section 3, namely that EgoVista is not a party to the downstream clauses and cannot produce them, is carried down onto the supplier line concerned. No supplier is added, removed or replaced, no transfer basis changes, and no category of data changes. ## 3. The four transfer regimes Version 1.0 carried the statement "not applicable, processing within the Union" on five lines. That statement was inaccurate. It is not defensible for any supplier whose contracting entity is established outside the European Economic Area, because the support, administration and control-plane access of such a supplier constitute a transfer within the meaning of Chapter V of the General Data Protection Regulation, even where storage and the main computation are pinned to a European region. The correction does not consist in writing "standard contractual clauses" on all eleven lines either, which would be inaccurate in a different way. Reading the contracts reveals four distinct regimes. **Regime A — direct standard contractual clauses.** The contracting entity is established outside the European Economic Area. The clauses of Implementing Decision 2021/914 bind EgoVista and the supplier directly, and EgoVista can produce them. Seven suppliers. **Regime B — European entity with mandated transfer.** The contracting entity is established within the European Economic Area, but the contract has the customer expressly mandate the transfer to the United States and to any other country of establishment, the clauses being put in place by the supplier. One supplier. **Regime C — downstream guarantee.** The contracting entity and the customer's billing address are both located in a country benefiting from an adequacy decision. The contract then states that no standard contractual clauses are required between the parties, and places the guarantee between the supplier and its own sub-processors. One supplier. A consequence worth stating: EgoVista is not a party to those clauses and therefore cannot produce them to a supervisory authority; it can only evidence the supplier's undertaking by reference to that supplier's published transfer documentation. **Regime D — no transfer.** The contracting entity is established in the European Union and the processing takes place there. Two suppliers. **A note on vocabulary.** Localisation undertakings do not all cover the same geography and are not interchangeable. Microsoft's undertaking covers the European Union and the European Free Trade Association, which includes Switzerland; Switzerland is not part of the European Economic Area and is covered by an adequacy decision. Iceland and Norway are members of the European Economic Area and apply the General Data Protection Regulation, so processing there is not a transfer. And a country described as "adequate" under a contract is not the same thing as a Member State of the Union. **On the Data Privacy Framework.** Several suppliers rely on it. The Framework remains valid but is the subject of a pending appeal before the Court of Justice of the European Union. EgoVista does not rely on it as a standalone basis. Where it is mentioned below, it is a complement to standard contractual clauses and never a substitute for them. A certification claimed by a supplier in its own documentation is not a verified certification; verification is carried out against the public list maintained by the United States Department of Commerce. ## 4. The suppliers State of affairs observed on 7 August 2026. Eleven suppliers. | Supplier and contracting entity | Purpose and categories of data | Location | Transfer basis and contract reference | |---|---|---|---| | **Cloudflare, Inc.**
San Francisco, California, United States | Object storage of video sequences and deliverables. Raw and blurred sequences, annotation artefacts, access logs. | Bucket created with European Union jurisdiction. Metadata and logs are not confined, the localisation suite being reserved to the Enterprise tier. | **Regime A.** Standard contractual clauses 2021/914, module 2, German law, courts of Munich. The supplier also adheres to the Data Privacy Framework; that adherence is a complement to the clauses and not a substitute for them. Contract v6.4 of 3 April 2026, incorporated into the terms. | | **Supabase Pte. Ltd**
Singapore | Platform database. Contributor accounts, submission metadata, evidence tables, remuneration ledger. | European region selected. Article 6.1 of the contract states that storage and processing are "primarily" in the chosen region, which leaves an opening. | **Regime A.** Singapore benefits from no adequacy decision. Standard contractual clauses 2021/914, module 2, Irish law. Contract v1 of 1 August 2026, incorporated into the terms. | | **Vercel Inc.**
Delaware, United States | Hosting of the web application. Request logs, telemetry, account data. No video sequence transits this layer, upload going from the browser to object storage by pre-signed URL. | Primary facilities in the United States (article 13). Backups replicated worldwide. | **Regime A.** Standard contractual clauses 2021/914. Contract of 17 March 2026, effective 31 March 2026, applicable only to the Pro and Enterprise tiers. **The account is on the free tier, so no data processing agreement is in force with this supplier at the date of this version.** Migration to a paid tier is engaged. | | **Plus Five Five, Inc. (Resend)**
San Francisco, California, United States | Sending of transactional emails. Email addresses, name, message content. | Primary operations in the United States (article 6.1). The selection of the Irish region covers sending and not the processing as a whole. | **Regime A.** Standard contractual clauses 2021/914, Irish law. The supplier also adheres to the Data Privacy Framework, as a complement to the clauses. Contract of 31 December 2025, incorporated, signed counterpart available. | | **Functional Software, Inc. (Sentry)**
San Francisco, California, United States | Application error monitoring. Error messages and stack traces, which may contain email addresses and contributor identifiers. | European Union storage region, chosen at account creation and not modifiable. | **Regime A.** Standard contractual clauses 2021/914, Irish supervisory authority. The supplier also adheres to the Data Privacy Framework, as a complement to the clauses. Contract v5.1.0, explicit acceptance required, accepted on 3 August 2026. | | **Runpod, Inc.**
New Jersey, United States | GPU compute for segmentation and depth. Blurred sequences, intermediate annotation artefacts. | Compute centres selected within the European Economic Area by means of the endpoint isolation feature. The contract carries no regional undertaking: article 4 provides for worldwide hosting and mere reasonable efforts at geographically proximate allocation, and annex 1 makes configuration a customer responsibility. | **Regime A.** Standard contractual clauses 2021/914, module 2 only, Irish law and courts. United Kingdom, Switzerland, Brazil and US state law addenda. Not certified under the Data Privacy Framework. Fourteen named sub-processors, twelve of which carry a United States entity. **The supplier maintains a further list of sub-processors that it discloses only under a confidentiality agreement; EgoVista has requested that agreement and has not yet received the list.** Contract executed by both parties on 3 August 2026, reference FZCKM-NTZUR-CPS76-U75AZ. | | **Upstash, Inc.**
Delaware, United States | Rate limiting of application routes. Truncated SHA-256 fingerprint of an IP address or of an email address. Pseudonymised data, not anonymous. | Redis database created on 3 August 2026 in the Frankfurt region (eu-central-1), with no secondary read region, that feature being reserved to paid tiers. The contract carries no regional undertaking. | **Regime A.** Standard contractual clauses 2021/914, modules 2 and 3 pre-wired, Irish law and courts. Data Privacy Framework claimed by the supplier, not verified against the official list. Contract of April 2025, incorporated into the terms. Service brought into use on 3 August 2026, no data having transited before that date. | | **Microsoft Ireland Operations Limited**
Dublin, Ireland (to be confirmed) | Quality-control container (Container Instances) and image registry (Container Registry). Technical probe artefacts, submission identifiers. | Container deployed in France Central. The contractual undertaking covers the European Union and the European Free Trade Association, for the services covered by the data boundary only, the list of which lives in the Product Terms. | **Regime B.** The contract has the customer mandate the transfer to the United States or to any other country of establishment. Standard contractual clauses 2021/914 put in place by the supplier, IDTA for the United Kingdom, Data Privacy Framework certification. Data Protection Addendum of 22 May 2026, incorporated into the Product Terms. The contracting entity is not named in the addendum and is to be confirmed on the first invoice issued. | | **Google Cloud EMEA Limited**
Dublin, Ireland | Generation of annotation labels (Vertex AI). Video sequences with blurred faces, labels produced. | A single processing path, pinned to a European region, with a check that halts processing when the region is not European. The alignment of the second path described in version 1.1 of this list is complete. See section 5.3 of version 1.2 of the technical annex. | **Regime C.** The contracting entity and the billing address both being in an adequate country, no standard contractual clauses apply between EgoVista and Google. The processor-to-processor clauses, with Google as exporter, apply between Google and its own sub-processors. **EgoVista is not a party to those clauses and cannot produce them to a supervisory authority; it can evidence the undertaking only by reference to the supplier's published transfer documentation.** Cloud Data Processing Addendum, English version in force at 3 August 2026. | | **Wise Europe SA**
Brussels, Belgium | Payment of contributor remuneration outside the SEPA zone. Name, country of residence, bank details. No bank details are stored in the EgoVista database. | Established in the European Union. | **Regime D.** The principal relationship does not constitute a transfer within the meaning of Chapter V. The supplier acknowledges transfers outside the European Economic Area under standard contractual clauses. **Contract not yet collected; no payment has been executed to date.** | | **Olinda SAS (Qonto)**
Paris, France | Company bank account and SEPA transfers. Name, country, bank details of the beneficiary. | Established in France. | **Regime D.** No transfer. The supplier states that it does not transfer payment data outside the European Economic Area. Qualified as a separate controller rather than a processor, a qualification to be confirmed. **Contract not yet collected; no payment has been executed to date.** | ## 5. Changes to this list EgoVista may change the supplier used within a functional category subject to thirty days' prior notice published on this page. Substantial changes, in particular changes affecting the country of processing, are notified by email to registered users. A full review is scheduled for 31 August 2026. Four items will give rise to a new version of this document: the move to paid tiers with the application hosting and database suppliers, receipt of the confidential sub-processor list from the compute supplier, the collection of the payment providers' contracts, and the completion of the migration of accounts to company identities. A fifth item, the switchover of the labelling path, is complete and is reflected in the present version. Questions on this document can be addressed to privacy@egovista.app. --- *Document drafted with the assistance of an artificial intelligence system and validated by EgoVista SAS.*