Subprocessors

Suwali relies on a number of third-party service providers ("subprocessors") that we engage to process personal data on behalf of organizations using Suwali, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR). Each subprocessor is contractually bound to process personal data in accordance with written instructions, to ensure appropriate technical and organisational security measures, and compliance with applicable data protection laws. Access to personal data is limited to what is necessary for the performance of the services described below.

Amazon Web Services, Inc.

Nature and purpose of processing: Cloud infrastructure and hosting services, including the use of Amazon Bedrock for AI-powered summarization.

• Address: 410 Terry Avenue North, Seattle, WA 98109-5210, USA
• Contact: aws.amazon.com/compliance/gdpr-center

Meta Platforms Ireland Limited (WhatsApp Business API — operative entity: WhatsApp Ireland Limited)

Nature and purpose of processing: Messaging service provider enabling communication with end users via WhatsApp, only when the WhatsApp integration is enabled.

• Address: 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
• Contact: privacy@meta.com

Telegram Messenger LLP (EEA representative: European Data Protection Office (EDPO))

Nature and purpose of processing: Messaging service provider enabling communication with end users via Telegram, only when the Telegram integration is enabled.

• Address: Registered: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, UK
• Contact: https://edpo.com/telegram-gdpr-data-request/

Google LLC (Google Cloud Platform / Google APIs)

Nature and purpose of processing: Limited access to Google Drive data solely for the purpose of processing folders and files explicitly shared with the application, if any.

• Address: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
• Contact: https://support.google.com/cloud/contact/dpo

OpenAI Ireland Limited (EEA/Swiss controller entity)

Nature and purpose of processing: AI service provider used for content extraction and question-answering functionality based on data submitted by the application.

• Address: 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland
• Contact: privacy@openai.com

Functional Software, Inc. (d/b/a Sentry)

Nature and purpose of processing: Error-tracking services used to record technical issues.

• Address: 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA
• Contact: legal@sentry.io

Cloudflare, Inc.

Nature and purpose of processing: Network security, content delivery, and traffic routing services used to protect and optimize application traffic.

• Address: 101 Townsend Street, San Francisco, CA 94107, USA
• Contact: privacyquestions@cloudflare.com

Neo4j, Inc. (Neo4j Aura; EEA controller entities: Neo4j Sweden AB, Neo4j Germany GmbH, Neo4j UK Limited)

Nature and purpose of processing: Managed graph database hosting used to store structured application data.

• Address: US: 400 Concar Drive, San Mateo, CA 94402, USA
• Contact: https://preferences.neo4j.com/privacy