--- version: "1.3" effective_from: "2026-09-11" title: "Sub-processors and Recipients" document_url: "/legal/sub-processors/1.3.md" --- # Sub-processors and Recipients **Version 1.3 — Effective 11 September 2026** Controller: EgoVista SAS, 47 rue Vivienne, 75002 Paris, France — SIREN 106 489 735 --- ## 1. Purpose, scope and relation to our other documents This document lists the suppliers to which EgoVista SAS entrusts the processing of personal data, together with the recipients acting as controllers in their own right. For each of them it states the contracting entity, the purpose, the categories of data concerned, the place of processing, and the basis on which any transfer outside the European Economic Area takes place. It is the single source on the identity of suppliers and on transfer bases. Identifiers and versions of technical components live in the technical annex. Retention periods live in the retention and deletion policy. The purposes and legal bases of each processing operation live in the privacy policy and in the record of processing activities. Those documents reference this one and do not restate its content. **It describes a state of affairs observed on 11 September 2026.** Where a contractual arrangement is incomplete, this document says so on the line concerned rather than omitting it. A gap that is written down is a statement of fact; a gap that is passed over in silence is not. This is the public version of an internal document. The internal version additionally contains an analysis of clauses common to the contracts examined, a review of account ownership and authentication, and the open points being resolved. Those sections concern the internal conduct of the company and are not reproduced here. Section numbering in this public version is continuous and does not follow the internal numbering. ## 2. Version history **Version 1.0, 3 August 2026.** Nine suppliers. Carried the statement "not applicable, processing within the Union" on five lines. Internal version, not published. **Version 1.1, 3 August 2026.** Eleven suppliers. Full correction of the transfer bases and introduction of the typology of four regimes described in section 3. Addition of Upstash, Inc. and Microsoft Ireland Operations Limited. **Version 1.2, 7 August 2026.** Eleven suppliers, unchanged. The labelling path switchover is complete: the line concerning the label generation supplier no longer describes a secondary path undergoing alignment, and that item is removed from the review scheduled for 31 August. The consequence of regime C stated in section 3, namely that EgoVista is not a party to the downstream clauses and cannot produce them, is carried down onto the supplier line concerned. No supplier is added, removed or replaced, no transfer basis changes, and no category of data changes. **Version 1.3, 11 September 2026.** Thirteen suppliers. This version corrects statements about payment that had ceased to be accurate and adds two suppliers. Four corrections. Contributor payments **have** been executed: version 1.2 stated on two lines that none had, which was true when written and is no longer. The categories of data entrusted to each payment provider are restated by reference to the method actually used, which differ: outside the SEPA zone the provider collects the beneficiary's bank details directly and EgoVista never receives them, whereas within the SEPA zone EgoVista holds them. The statement "no bank details are stored in the EgoVista database", carried on the Wise line and correct as to that supplier, is restated so that it is not read as a statement about EgoVista as a whole, which it never was and which version 2.4 of the Contributor Terms makes explicit. The review scheduled for 31 August is reported on at section 5. Two additions. **PayPal (Europe) S.à r.l. et Cie, S.C.A.**, for contributor payment in countries where the beneficiary holds an account identified by an electronic address; the service is not yet in use and the line says so. **Google Ireland Limited**, for the survey forms used to collect contributor equipment and payment preferences; that processing was in service before this version and was not listed, which this version corrects. No transfer basis of an existing supplier changes. ## 3. The four transfer regimes Version 1.0 carried the statement "not applicable, processing within the Union" on five lines. That statement was inaccurate. It is not defensible for any supplier whose contracting entity is established outside the European Economic Area, because the support, administration and control-plane access of such a supplier constitute a transfer within the meaning of Chapter V of the General Data Protection Regulation, even where storage and the main computation are pinned to a European region. The correction does not consist in writing "standard contractual clauses" on all lines either, which would be inaccurate in a different way. Reading the contracts reveals four distinct regimes. **Regime A — direct standard contractual clauses.** The contracting entity is established outside the European Economic Area. The clauses of Implementing Decision 2021/914 bind EgoVista and the supplier directly, and EgoVista can produce them. Seven suppliers. **Regime B — European entity with mandated transfer.** The contracting entity is established within the European Economic Area, but the contract has the customer expressly mandate the transfer to the United States and to any other country of establishment, the clauses being put in place by the supplier. Two suppliers. **Regime C — downstream guarantee.** The contracting entity and the customer's billing address are both located in a country benefiting from an adequacy decision. The contract then states that no standard contractual clauses are required between the parties, and places the guarantee between the supplier and its own sub-processors. One supplier. A consequence worth stating: EgoVista is not a party to those clauses and therefore cannot produce them to a supervisory authority; it can only evidence the supplier's undertaking by reference to that supplier's published transfer documentation. **Regime D — no transfer.** The contracting entity is established in the European Union and the processing takes place there. Three suppliers. **A note on vocabulary.** Localisation undertakings do not all cover the same geography and are not interchangeable. Microsoft's undertaking covers the European Union and the European Free Trade Association, which includes Switzerland; Switzerland is not part of the European Economic Area and is covered by an adequacy decision. Iceland and Norway are members of the European Economic Area and apply the General Data Protection Regulation, so processing there is not a transfer. And a country described as "adequate" under a contract is not the same thing as a Member State of the Union. **On the Data Privacy Framework.** Several suppliers rely on it. The Framework remains valid but is the subject of a pending appeal before the Court of Justice of the European Union. EgoVista does not rely on it as a standalone basis. Where it is mentioned below, it is a complement to standard contractual clauses and never a substitute for them. A certification claimed by a supplier in its own documentation is not a verified certification; verification is carried out against the public list maintained by the United States Department of Commerce. **A note on payment providers.** A payment provider executing a transfer on EgoVista's instruction acts, as to that transfer, under its own regulatory obligations and not solely on EgoVista's instructions. The qualification of each as processor or as separate controller is stated on its line and, where it is not settled, said to be not settled rather than asserted. ## 4. The suppliers State of affairs observed on 11 September 2026. Thirteen suppliers. | Supplier and contracting entity | Purpose and categories of data | Location | Transfer basis and contract reference | |---|---|---|---| | **Cloudflare, Inc.**
San Francisco, California, United States | Object storage of video sequences and deliverables. Raw and blurred sequences, annotation artefacts, access logs. | Bucket created with European Union jurisdiction. Metadata and logs are not confined, the localisation suite being reserved to the Enterprise tier. | **Regime A.** Standard contractual clauses 2021/914, module 2, German law, courts of Munich. The supplier also adheres to the Data Privacy Framework; that adherence is a complement to the clauses and not a substitute for them. Contract v6.4 of 3 April 2026, incorporated into the terms. | | **Supabase Pte. Ltd**
Singapore | Platform database. Contributor accounts, submission metadata, evidence tables, remuneration ledger, and the encrypted bank details described on the Qonto line. | European region selected. Article 6.1 of the contract states that storage and processing are "primarily" in the chosen region, which leaves an opening. | **Regime A.** Singapore benefits from no adequacy decision. Standard contractual clauses 2021/914, module 2, Irish law. Contract v1 of 1 August 2026, incorporated into the terms. | | **Vercel Inc.**
Delaware, United States | Hosting of the web application. Request logs, telemetry, account data. No video sequence transits this layer, upload going from the browser to object storage by pre-signed URL. | Primary facilities in the United States (article 13). Backups replicated worldwide. | **Regime A.** Standard contractual clauses 2021/914. Contract of 17 March 2026, effective 31 March 2026, applicable only to the Pro and Enterprise tiers. **The account is on the free tier, so no data processing agreement is in force with this supplier at the date of this version.** Migration to a paid tier is engaged. | | **Plus Five Five, Inc. (Resend)**
San Francisco, California, United States | Sending of transactional emails. Email addresses, name, message content. | Primary operations in the United States (article 6.1). The selection of the Irish region covers sending and not the processing as a whole. | **Regime A.** Standard contractual clauses 2021/914, Irish law. The supplier also adheres to the Data Privacy Framework, as a complement to the clauses. Contract of 31 December 2025, incorporated, signed counterpart available. | | **Functional Software, Inc. (Sentry)**
San Francisco, California, United States | Application error monitoring. Error messages and stack traces, which may contain email addresses and contributor identifiers. | European Union storage region, chosen at account creation and not modifiable. | **Regime A.** Standard contractual clauses 2021/914, Irish supervisory authority. The supplier also adheres to the Data Privacy Framework, as a complement to the clauses. Contract v5.1.0, explicit acceptance required, accepted on 3 August 2026. | | **Runpod, Inc.**
New Jersey, United States | GPU compute for segmentation and depth. Blurred sequences, intermediate annotation artefacts. | Compute centres selected within the European Economic Area by means of the endpoint isolation feature. The contract carries no regional undertaking: article 4 provides for worldwide hosting and mere reasonable efforts at geographically proximate allocation, and annex 1 makes configuration a customer responsibility. | **Regime A.** Standard contractual clauses 2021/914, module 2 only, Irish law and courts. United Kingdom, Switzerland, Brazil and US state law addenda. Not certified under the Data Privacy Framework. Fourteen named sub-processors, twelve of which carry a United States entity. **The supplier maintains a further list of sub-processors that it discloses only under a confidentiality agreement; EgoVista has requested that agreement and has not yet received the list.** Contract executed by both parties on 3 August 2026, reference FZCKM-NTZUR-CPS76-U75AZ. | | **Upstash, Inc.**
Delaware, United States | Rate limiting of application routes. Truncated SHA-256 fingerprint of an IP address or of an email address. Pseudonymised data, not anonymous. | Redis database created on 3 August 2026 in the Frankfurt region (eu-central-1), with no secondary read region, that feature being reserved to paid tiers. The contract carries no regional undertaking. | **Regime A.** Standard contractual clauses 2021/914, modules 2 and 3 pre-wired, Irish law and courts. Data Privacy Framework claimed by the supplier, not verified against the official list. Contract of April 2025, incorporated into the terms. Service brought into use on 3 August 2026, no data having transited before that date. | | **Microsoft Ireland Operations Limited**
Dublin, Ireland (to be confirmed) | Quality-control container (Container Instances) and image registry (Container Registry). Technical probe artefacts, submission identifiers. | Container deployed in France Central. The contractual undertaking covers the European Union and the European Free Trade Association, for the services covered by the data boundary only, the list of which lives in the Product Terms. | **Regime B.** The contract has the customer mandate the transfer to the United States or to any other country of establishment. Standard contractual clauses 2021/914 put in place by the supplier, IDTA for the United Kingdom, Data Privacy Framework certification. Data Protection Addendum of 22 May 2026, incorporated into the Product Terms. The contracting entity is not named in the addendum and is to be confirmed on the first invoice issued. | | **Google Cloud EMEA Limited**
Dublin, Ireland | Generation of annotation labels (Vertex AI). Video sequences with blurred faces, labels produced. | A single processing path, pinned to a European region, with a check that halts processing when the region is not European. See the technical annex, section 5.3. | **Regime C.** The contracting entity and the billing address both being in an adequate country, no standard contractual clauses apply between EgoVista and Google. The processor-to-processor clauses, with Google as exporter, apply between Google and its own sub-processors. **EgoVista is not a party to those clauses and cannot produce them to a supervisory authority; it can evidence the undertaking only by reference to the supplier's published transfer documentation.** Cloud Data Processing Addendum, English version in force at 3 August 2026. | | **Google Ireland Limited**
Dublin, Ireland | Survey forms used to collect contributors' equipment and payment preferences (Google Forms). Free-text answers, and the email address where the respondent chooses to give one. **No bank details and no identity document are collected through this channel.** | European region for the services covered by the supplier's data regions commitment; support and administration are worldwide. | **Regime B.** The contracting entity is established in the European Economic Area, the contract mandating the transfer to the United States and to any other country of establishment, with standard contractual clauses 2021/914 put in place by the supplier. Google Workspace Data Processing Addendum. **This processing was brought into service on 6 September 2026 and was not listed in version 1.2; the omission is corrected here rather than passed over.** | | **Olinda SAS (Qonto)**
Paris, France | Company bank account and SEPA transfers. Beneficiary name, country, bank details. **This is the only method under which EgoVista holds a contributor's bank details.** They are encrypted before they reach the database, the key never being transmitted to it, and are described in the privacy policy with their legal basis and retention period. | Established in France. | **Regime D.** No transfer. The supplier states that it does not transfer payment data outside the European Economic Area. Qualified as a separate controller rather than a processor, **a qualification that is not settled**. **Contract not yet collected.** Payments have been executed through this supplier. | | **Wise Europe SA**
Brussels, Belgium | Payment of contributor remuneration outside the SEPA zone. Beneficiary name, email address, amount, currency, payment reference. **The beneficiary supplies his or her bank details directly to Wise, through a secure link Wise sends to that address. EgoVista neither receives nor holds them.** | Established in the European Union. | **Regime D.** The principal relationship does not constitute a transfer within the meaning of Chapter V. The supplier acknowledges transfers outside the European Economic Area under standard contractual clauses. **Contract not yet collected.** Account opened on 9 September 2026; the service is in use for the corridors stated on the withdrawal page. | | **PayPal (Europe) S.à r.l. et Cie, S.C.A.**
Luxembourg | Payment of contributor remuneration to an account held by the beneficiary with this supplier and identified by an electronic address. Beneficiary email address, amount, currency, payment reference. **No bank details are transmitted by EgoVista.** | Established in the European Union. | **Regime D.** The principal relationship does not constitute a transfer within the meaning of Chapter V. The supplier acknowledges transfers outside the European Economic Area under standard contractual clauses. **Contract not yet collected. Account opened on 9 September 2026. The payout facility is not activated and no payment has been executed through this supplier; the corridors concerned are closed on the withdrawal page until it is.** | ## 5. Changes to this list EgoVista may change the supplier used within a functional category subject to thirty days' prior notice published on this page. Substantial changes, in particular changes affecting the country of processing, are notified by email to registered users. **The review scheduled for 31 August 2026.** Of the four items it carried, none is closed. The move to paid tiers with the application hosting and database suppliers is engaged and not complete; the confidential sub-processor list from the compute supplier has been requested and not received; the payment providers' contracts are not collected; the migration of accounts to company identities is not complete. They are carried forward to the next review, **scheduled for 31 October 2026**, together with two items opened by the present version: the settling of the Qonto qualification, and the activation of the PayPal payout facility. Questions on this document can be addressed to privacy@egovista.app. --- *Document drafted with the assistance of an artificial intelligence system and validated by EgoVista SAS.*