Sub-processor directory

Observata Sweden AB engages the third-party sub-processors listed below to support service delivery and process personal data on behalf of our customers.

• Provided service: Infrastructure, managed hosting, backup and recovery.
• Processing scope & purpose: Hosts, stores, protects and restores customer service data on Observata-managed platforms.
• Processing location: Primary: Germany. Backup & Recovery: Finland.

• Provided service: Zoho CRM, Zoho Desk, identity and account administration.
• Processing scope & purpose: Manages customer point-of-contact records, support cases, access entitlements and service correspondence.
• Processing location: European Union (Zoho EU data centres); transfers outside the EEA are governed by Zoho's corporate terms and DPA.

• Provided service: Video conferencing, telephony, call recording and transcription.
• Processing scope & purpose: Transmits and documents operational calls and project workshops, including recordings, transcripts and summaries where active.
• Processing location: As governed by Zoom's enterprise agreements and data processing. terms

• Provided service: AI-assisted analytical workflows.
• Processing scope & purpose: Executes approved workflows, including automated summarisation, contextual search, knowledge retrieval and documentation draft assistance.
• Processing location: As governed by OpenAI's commercial terms and DPA; cross-border transfers incorporate EU Standard Contractual Clauses.

Observata operates its own dedicated security monitoring and observability platforms internally. This operational capability is delivered directly by Observata Sweden AB personnel and does not constitute a third-party sub-processor.

Where this monitoring is hosted within an Observata-managed cloud environment, the underlying hosting and backup providers remain as specified in the directory above.

We review and update this directory as our operational footprint and vendor ecosystem adapt. In accordance with applicable customer agreements and Data Processing Addenda (DPAs), we provide advance notification to designated customer contacts before onboarding or replacing any material sub-processor handling customer data.

For questions regarding third-party vendors, transfer mechanisms or our Data Processing Addendum, please contact legal@observata.com.