Sub-processors

The sub-processors below process Customer Data. Any change is notified in accordance with clause 4.4.

• Google Cloud. Country of establishment: EU contracting entity designated in the Google Cloud Master Agreement. Evidence produced on request. Country of processing: Belgium (europe-west1). Backups: European Union. Purpose: Hosting, database, object storage, compute, messaging, secret management, logging. Transfer basis: No transfer for storage. Group access covered by the standard contractual clauses and the Data Privacy Framework.

• Functional Software, Inc. (Sentry). Country of establishment: United States. Country of processing: Germany (EU region of the provider). Purpose: Monitoring of application errors. Users are identified by an opaque Keycloak identifier only. Retention 90 days. Transfer basis: Standard contractual clauses. Agreement signed on 5 June 2026.

• Grafana Labs (Raintank, Inc.). Country of establishment: United States. Country of processing: European Union. Purpose: Technical logging and monitoring. Authentication logs and logs of sensitive operations. Retention periods set out in Annex 3. Transfer basis: Standard contractual clauses. Agreement signed on 5 June 2026.

• AC PM LLC (Postmark). Country of establishment: United States. Country of processing: United States. Purpose: Sending of transactional emails and alert notifications to the users of the Customer. Transfer basis: Standard contractual clauses and Data Privacy Framework.

• Mixpanel. Country of establishment: United States. Country of processing: European Union (EU region activated). Purpose: Analysis of product usage. Transfer basis: Standard contractual clauses and Data Privacy Framework.

• OpenAI. Country of establishment: United States. Country of processing: United States. Purpose: Language model analyses. Transfer basis: Standard contractual clauses. Contractual undertaking not to train on Customer Data. Agreement signed on 13 May 2026.

• Google (Gemini via Vertex AI). Country of establishment: Same contracting entity as Google Cloud above. Country of processing: European Union, through the Google Cloud region europe-west1. Purpose: Language model analyses. Processing located within the European Union. Transfer basis: Covered by the Google Cloud Data Processing Addendum. Contractual undertaking not to train on Customer Data.

Two clarifications. First, the tools used internally by the Processor for customer relationship management, internal communication, documentation and source code management do not process Customer Data within the meaning of this Agreement; they contain the business contact details of the Customer's representatives, in respect of which the Processor is itself the controller. A list is provided on request. Second, the transcription of parliamentary debates and of the sessions of the Council of the European Union is carried out by Gladia, a company established in France (RCS Rennes 909 935 736) which processes the audio in France, under an agreement signed on 4 June 2026. Gladia acts on behalf of the Processor acting as a controller, on publicly broadcast recordings only, and receives no Customer Data. It therefore does not appear in the table above and is named here so that the Customer has a complete view of the processing chain.

Any change to this list is notified in writing at least thirty (30) days before it takes effect, in accordance with clause 4.4 of the data processing agreement. The Customer may object within that period on data protection grounds and, failing agreement, terminate without charge for the remaining term. To be notified of every change, write to dpo@dixitplatform.com from your business address.

*Version in force since September 9, 2026. Every published version is archived at a permanent address, listed on the Legal documents page.*