Sub-processors

This list identifies the providers (sub-processors) that VERYPYME SERVICIOS DIGITALES, S.L. relies on to provide its services when it processes personal data on behalf of its customers, under the terms of the Data Processing Agreement (DPA). Providers involved in processing for which VeryPyme is the controller are also included, with an express indication, to give a complete picture.

The list is versioned. Each new version states its effective date. VeryPyme will give notice of additions and replacements as provided in the DPA (clause 12) and in the Privacy Policy.

1. Google Cloud (Google Cloud EMEA Limited, Ireland, and Google group entities)

Services: Firebase Authentication (identity and access), Cloud Firestore (database), Cloud Storage for Firebase (document and file storage), Vertex AI (artificial intelligence features) and Cloud Tasks (background processing queues).

Purpose: hosting and processing of platform data, user authentication, storage of the documentation provided and automated analysis of documents.

Data categories: account and contact data, organisation data, documentation and evidence provided by customers and the information extracted from them, answers and assessments.

Region: the database and file storage are configured in the European region of Belgium (europe-west1) and the artificial intelligence features in the European region of the Netherlands (europe-west4). Firebase Authentication is a global Google service.

International transfers: Google acts as a processor under its Cloud Data Processing Addendum, which incorporates the international transfer commitments (European Union standard contractual clauses) that apply where Google or its sub-processors access data from outside the European Economic Area, for example for support or operational purposes.

2. Vercel Inc. (United States)

Services: hosting of the web application, execution of server functions, scheduled tasks and technical logs.

Purpose: publication and operation of VeryPyme.

Data categories: all application traffic (IP addresses, data transmitted in requests) and technical server logs.

Region: Vercel states that its primary processing facilities are located in the United States. Certain payment functions run in the Frankfurt region.

International transfers: Vercel Inc. is certified under the EU-U.S. Data Privacy Framework and its Data Processing Addendum incorporates the European Union standard contractual clauses.

3. Stripe (Stripe Payments Europe, Limited, Ireland, and Stripe, Inc., United States)

Services: payment processing and billing customer management.

Purpose: collection of payment for the services purchased.

Data categories: email address, name or company name and billing address, amounts and payment references. Card details are entered directly in Stripe's forms and are not received by VeryPyme.

Role: Stripe acts as an independent controller for payment processing, fraud prevention and regulatory compliance, and as a processor for certain data that VeryPyme communicates to it.

International transfers: Stripe, Inc. is certified under the EU-U.S. Data Privacy Framework and Stripe's Data Processing Agreement incorporates the European Union standard contractual clauses.

4. Resend (Plus Five Five, Inc., United States)

Services: sending of transactional emails.

Purpose: supplier invitations, access activations and purchase confirmations.

Data categories: recipient email address, name of the sending or invited company, amounts and access links.

Region: Resend states that its primary processing operations take place in the United States.

International transfers: Resend is certified under the EU-U.S. Data Privacy Framework and its Data Processing Agreement incorporates the European Union standard contractual clauses (module two).

5. Geoapify (company established in the European Union)

Services: geocoding, address autocomplete and static maps.

Purpose: locating the sites and addresses entered by the user.

Data categories: address text entered by the user, coordinates and the browser's IP address, since queries are made from the user's own browser.

Region: Geoapify states that its services are hosted in European Union data centres and that it retains data on successful requests for no longer than 24 hours.

6. Google Analytics (Google Ireland Limited, Ireland) — only with consent

Services: website usage analytics.

Purpose: measuring the use and performance of VeryPyme.

Data categories: cookie identifiers, IP address, pages visited and technical browser data. It is only activated if the user accepts analytics cookies; it may involve transfers to the United States, covered by the safeguards Google provides for this service.

This provider is involved in processing for which VeryPyme is the controller; it is included for information purposes.

7. Public data services without identifying personal data

For the climate and environmental risk features, VeryPyme queries public and scientific services (Copernicus, MITECO, IDEE, European Environment Agency, WRI Aqueduct, EFEHR and EMSC) sending only the geographic coordinates of the site analysed. No names, emails or user identifiers are communicated. They are not sub-processors for the purposes of the DPA.