Data Processing Agreement

Authorised sub-processors

B.1. Approved sub-processors
On commencement of the Clauses, the data controller authorizes the engagement of the following sub-processors each table provides information of the subprocessor applicable for the related platform:

P2P

NAME	Location of processing	DESCRIPTION OF PROCESSING	COMMENT	TYPE OF DATA
Amazon Web Services EMEA SARL (AWS)	Germany, Ireland	Data Center hosting		a) User data b) Supplier data information c) Unstructured information in business document
Atlassian Corporation Plc	The data is stored in AWS in the EU (Ireland and Germany)	Support ticket system external to the system	Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs.	The data include profile information such as: Name, email address, organization, and job title. The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket.
ECIT	Poland	Invoice Scanning Services	Only relevant for Invoice/match customers + Norwegian customers.	Unstructured information in business document
Exadel GmbH	Germany, Spain	Software developing services		• Customer data • Name • Email addresses • Support tickets
Mailgun	Germany, Belgium, Bulgaria, France	Email deliverability platform		Name, email
Miracle A/S	Denmark	Document integration services		Name, email, telephone number, delivery address, unstructured information on business documents
Tickstar AB	AWS Germany, Ireland	Document delivery processing	Only relevant for Invoice/match customers + Norwegian customers.	Unstructured information in business document
Ubivox	Denmark, France the Netherlands	Email deliverability platform		Name, email
WorldLine (former Bambora)	Germany, Ireland Sweden	Payment service	Only relevant for P2P Webshop Customer With credit card payment	Name, payment credentials and order amount.
Zendesk	AWS Germany, Ireland	Support tickets		Historic support tickets. Content of the support ticket is limited to what the controller includes in such a support ticket

Opic

NAME	LOCATION OF PROCESSING	DESCRIPTION OF PROCESSING	TRANSFER TOOL	COMMENTS	Type of Data process
Visma ITC AS	Norway	Norway – Hosting	N/A		a) User data for employees of the customer b) Unstructured personal data in tender documents (About supplier d) User data e) Unstructured information in offers from suppliers that may contain personal data, such as in the CV of employees or subcontractors who included in the offer
Visma Labs SIA	Riga, Latvia	Software development	N/A
Atlassian Corporation Plc	The data is stored in AWS in the EU (Ireland and Germany) and the USA. Possible remote access from selected global countries where Atlassian operates.	Support ticket tool	NA		The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket. The data usually includes profile information such as: name, email address, organization, and job title.
Amazon Web Services	Germany.	Data Center hosting for Notice editor	N/A		Name, Email, Telephone

MTS/MSS

NAME	LOCATION OF PROCESSING	DESCRIPTION OF PROCESSING	TRANSFER TOOL	COMMENT	Type of data
Atlassian Corporation Plc	The data is stored in AWS in the EU (Ireland and Germany)	Support ticket system external to the system	N/A	Support tickets are handled externally by the system. Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs.	The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket
Amazon Web Services	Data is stored in AWS data centres in Germany.	Data Center hosting for Notice editor			Name, Email, Telephone
Signicat AS	Norway	Digital signature	N/A		Personal contact information (Name, Address, e-mail, phone number, etc.)
Inpadi ApS	Denmark	Hosting, Backup, Virtual Machines,	N/A		a) User data for employees of the customer b) Unstructured personal data in tender documents (About supplier d) User data e) Unstructured information in offers from suppliers that may contain personal data, such as in the CV of employees or subcontractors who included in the offer

Negometrix3/Source-to-contract

NAME	LOCATION OF PROCESSING	DESCRIPTION OF PROCESSING	TRANSFER TOOL	COMMENT	Type of date
Atlassian Corporation Plc	Data is stored in Amazon Web Services (AWS) in the EU (Ireland and Germany).	Processing of personal data related to support tickets raised regarding the use of Processor’s platform.	N/A	Support tickets are handled by a separate system (outside Processor’s platform). Atlassian offers data encryption at rest and in transit, as well as a number of other security measures to safeguard the privacy of its users in case of data transfer for other aspects.	The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket. The data usually includes profile information such as: name, email address, organization, and job title.
Microsoft Azure	Data is stored in Azure data centres in the Netherlands.	Hosting, backup, virtual machines	N/A		a) User data of user accounts for employees of the customer and (potential) supplier contacts b) Unstructured personal data in documents added by users
Amazon Web Services	Data is stored in AWS data centres in Germany.	Hosting, backup, virtual machines and Data Center hosting for Notice editor	N/A		a) User data of user accounts for employees of the customer and (potential) supplier contacts b) Unstructured personal data in documents added by users
Myracloud	Data is stored in data centres managed by Noris network, Equinix and Interxion in Germany and Austria.	DDOS protection	N/A	Only Myracloud employees have access to the data.	Name, e-mail address, session id, cookie/cookie like data, IP-address
Messagebird	Data is stored in Google Cloud Platform in the EU (Belgium and The Netherlands).	SMS text service for users relying on single sign on	N/A		Mobile phone number, IP-address
Dmarcian	Data is stored in Google Cloud Platform in the EU (Belgium).	E-mail delivery security	N/A		E-mail address, IP-address
Mailjet	Data is stored in Google Cloud data centres in the Netherlands and Belgium	E-mail automation	N/A		Name, e-mail address, IP address

ETHICS

NAME	Location of processing	DESCRIPTION OF PROCESSING	TRANSFER TOOL	COMMENT	TYPE OD DATA
Atlassian Corporation Plc	The data is stored in AWS in the EU (Ireland and Germany)	Support ticket system external to the system	N/A	Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs.	The data include profile information such as: Name, email address, organization, and job title. The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket.
Mailjet SAS	Germany, Belgium, Bulgaria, France	Email deliverability platform for transactional email			Name, email, telephone numbers, IP address
Auth0 Inc.	Germany /USA(only for support tickets related to log-in that cannot be handled internally at Mercell, and this is informed to the customer case by case before transfering)	Authentication and authorization platform	Standard Contractual Clauses	Auth0 processes all personal data in the EU. In the case of support tickets, Mercell as processor, received the tickets, and in case Mercell needs to involve Auth0 to resolve the issue. This ticket can be sent to Auth0 Inc. The data is limited to IP address and email address to solve the issue. Mercell inform the customer before the transfer is conducted and provide a TIA that shows the technical and organizational measure taken for ensure a high level of protection. Auth0 uses encryption of data, has strict access control rules, and follows the principle of data minimization.	Log in information Username Email address IP address
MongoDB Ltd	Germany, Ireland, France	Document-oriented database program, Data center hosting			a) User data for employees of the customer b) Unstructured personal data in tender documents (About supplier d) User data e) Unstructured information in offers from suppliers that may contain personal data, such as in the CV of employees or subcontractors who included in the offer
Amazon Web Services EMEA SARL (AWS)	Germany/ Ireland	E form Center hosting and subprocessor of MongoDB			a) User data for employees of the customer b) Unstructured personal data in tender documents (About supplier d) User data e) Unstructured information in offers from suppliers that may contain personal data, such as in the CV of employees or subcontractors who included in the offer

CTM

NAME	LOCATION OF PROCESSING	DESCRIPTION OF PROCESSING	TRANSFER TOOL	COMMENT	Type of date
Atlassian Corporation Plc	The data is stored in AWS in the EU (Ireland and Germany)	Support ticket system external to the system	N/A	Support tickets are handled externally of the system. Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs.	The data include profile information such as Name, email address, organization, and job title. The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket.
Signicat AS	Norway	Digital signature	N/A		Personal contact information (Name, Address, e-mail, phone number, etc.)
Amazon Web Services	Data is stored in AWS data centres in Germany.	Data Center hosting for Notice editor			Name, Email, Telephone

Cloudia

NAME	Location of processing	DESCRIPTION OF PROCESSING	TRANSFER TOOL	COMMENT	TYPE OF DATA
Atlassian Corporation Plc	The data is stored in AWS in the EU (Ireland and Germany)	Support ticket system external to the system	N/A	Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs.	The data include profile information such as: Name, email address, organization, and job title. The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket.
Amazon Web Services	Data is stored in AWS data centres in Germany.	Data Center hosting for Notice editor	N/A	N/A	Name, Email, Telephone
Equinix	Finland	Document-oriented database program, Data center hosting	N/A	N/A	a) User data for employees of the customer b) Unstructured personal data in tender documents (About supplier d) User data e) Unstructured information in offers from suppliers that may contain personal data, such as in the CV of employees or subcontractors who included in the offer
Zendesk	AWS Germany, Ireland	Support tickets	N/A	Historic support tickets. Content of the support ticket is limited to what the controller includes in such a support ticket	N/A

Udbudsvagten

NAME	Location of processing	DESCRIPTION OF PROCESSING	COMMENT	TYPE OF DATA
Amazon Web Services EMEA SARL (AWS)	Germany, Ireland	Data Center hosting	N/A	a) User data b) Supplier data information c) Unstructured information in business document
Atlassian Corporation Plc	The data is stored in AWS in the EU (Ireland and Germany)	Support ticket system external to the system	Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs. Atlassian offers data encryption at rest and in transit, as well as a number of other security measures to safeguard the privacy of its users in case of data transfer for other aspects.	The data include profile information such as: Name, email address, organization, and job title. The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket.
Auth0 Inc.	Germany /USA(only for support tickets related to log-in that cannot be handled internally at Mercell, and this is informed to the customer case by case before transfering)	Authentication and authorization platform	Auth0 processes all personal data in the EU. In the case of support tickets, Mercell as processor, received the tickets, and in case Mercell needs to involve Auth0 to resolve the issue. This ticket can be sent to Auth0 Inc. The data is limited to IP address and email address to solve the issue. Mercell inform the customer before the transfer is conducted and provide a TIA that shows the technical and organizational measure taken for ensure a high level of protection. Auth0 uses encryption of data, has strict access control rules, and follows the principle of data minimization. The transfer of data they use are SCC Standard Contractual Clauses	Log in information Username Email address IP address
Datadog	Germany	Monitoring for Support, troubleshooting of the technical infrastructure	N/A	N/A

Comcare

NAME	Location of processing	DESCRIPTION OF PROCESSING	COMMENT	TYPE OD DATA
Atlassian Corporation Plc	The data is stored in AWS in the EU (Ireland and Germany)	Support ticket system external to the system	Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs. Atlassian offers data encryption at rest and in transit, as well as a number of other security measures to safeguard the privacy of its users in case of data transfer for other aspects.	The data include profile information such as: Name, email address, organization, and job title. The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket.
Awexi	Denmark	Data Center hosting	Phisical	a) User data b) Supplier data information c) Unstructured information in business document
Exadel GmbH	Germany, Spain	Software developing sevices		• Customer data • Name • Email addresses • Support tickets

Truelink/Truetrade/TrueAnalysis

NAME	Location of processing	DESCRIPTION OF PROCESSING	COMMENT	TYPE OF DATA
Atlassian Corporation Plc	The data is stored in AWS in the EU (Ireland and Germany)	Support ticket system external to the system	Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs. Atlassian offers data encryption at rest and in transit, as well as a number of other security measures to safeguard the privacy of its users in case of data transfer for other aspects.	The data include profile information such as: Name, email address, organization, and job title. The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket.
Microsoft Inc.	Amsterdam, The Netherlands	Data Center Hosting	Azure Kubernetes Services, Azure Storage	a) User data b) Supplier data information c) Unstructured information in business document
ScanNet	Denmark	Vsphere Veeam Cloud Connect Tivoli Storage Manager	ScanNet is a hosting provider with 3 physical servers, dedicated to TrueLink, on which more than 30 virtual machines are running under control of the Vsphere software. All virtual machines are backuped on VM level each night as a image snapshot to external service Veeam Cloud Connect All virtual machines file system is backuped per file each night to external service Tivoli Storage Manager, additionally transaction logs from databases are shipped there on the fly	All data, which processed by all 3 platforms: • Customer data • Supplier data • Unstructured information in documents

Tendsign

NAME	LOCATION OF PROCESSING	DESCRIPTION OF PROCCESSING	COMMENT	TYPE OF DATA
Visma IT & Communications AS 556438-3544	Oslo / Norge	N/A	Lagring på servrar	Visma IT & Communications AS 556438-3544
Creditsafe i Sverige AB 556514-4408	Sverige	N/A	Kreditupplysning	Creditsafe i Sverige AB 556514-4408
Chambersign i Sverige AB 559037-9029	Sverige	N/A	Digital signering	Chambersign i Sverige AB 559037-9029
TwoDay A/S (Addo) VAT:DK29973334	Danmark	N/A	Digital signering	TwoDay A/S (Addo) VAT:DK29973334
TwoDay AB 556117-7543	Sverige	N/A	Arkivering/inloggning	TwoDay AB 556117-7543
TwoDay UAB VAT:LT100006193618	Litauen	N/A	Utveckling/underhåll/support	TwoDay UAB VAT:LT100006193618
Atlassian Jira	Germany	N/A	Kundportal för supportfrågor	Atlassian Jira
Amazon Web Services EMEA SARL 908705	Germany Frankfurt	N/A	Data Center hosting for Notice editor	Amazon Web Services EMEA SARL 908705

MERCELL APP

NAME	LOCATION OF PROCESSING	DESCRIPTION OF PROCESSING	DATA TRANSFER MECHANISM IF APPLICABLE	TYPE OF DATA	COMMENT
Amazon Web Services EMEA SARL (AWS)	Germany- Frankfurt	Data Center hosting	NA	a) User data b) Supplier data information c) Unstructured information in business document	NA
Atlassian Corporation Plc	The data is stored in AWS in the EU (Ireland and Germany)	Support ticket system external to the system	NA	The data include profile information such as Name, email address, organization, and job title. The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket.	NA
Visma IT & Communications AS	Norway- Sweden	Digital signature	NA	Name, Address, e-mail, job title	Subprocessor applicable depending on customer selection
DocuSign	Germany, Ireland	Digital signature	NA	Name, Address, e-mail, job title	Subprocessor applicable depending on customer selection
Signicat AS	Netherlands/Finland	Digital signature	NA	Name, Address, e-mail, job title	Subprocessor applicable depending on customer selection
Whatfix	Germany/ Ireland	Onboard, train, and support users on the platform; Use also for improving support	NA	Name, Email id, Company Name, IP Address, Platform Activity Data	NA

Companies in the Mercell Group

Name	Organization number	Place of processing	Processing activities	Transfer tools	Type of data	Comments
Mercell Commerce AB	Organizational number: SE556533874501 Lindhagensgatan 94 11218 Stockholm	Sweden Stockholm	IT and customer support	NA	a) User profile data: Name, address, email. IP address, unstructured data, employer, position. b) Unstructured personal data in tender documents (About supplier participating in bids c) Unstructured information in offers from suppliers that may contain d) personal data, such as in the CV of employees or subcontractor included in the offer
Mercell Norge AS	Organizational number: 990 638 942 Norway Askekroken 11, 0277 Oslo	Oslo-Norway	IT and customer support	NA	a) User profile data: Name, address, email. IP address, unstructured data, employer, position. b) Unstructured personal data in tender documents (About supplier participating in bids
Mercell Nederland B.V.	Organizational number: 30148169 Netherlands Rijnzathe 32, 3454 PV Utrecht, Netherlands	Netherlands- Utrecht	IT and customer support	NA	a) User profile data: Name, address, email. IP address, unstructured data, employer, position. b) Unstructured personal data in tender documents (About supplier participating in bids
Mercell Danmark A/S	CVR 2569885135665897 Vesterbrogade 149 1620 København	Copenhagen-Denmark	IT and customer support	NA	a) User profile data: Name, address, email. IP address, unstructured data, employer, position. b) Unstructured personal data in tender documents (About supplier participating in bids
Kontturi & Co Oy	Business identity code 1871273-5 Kauppakatu 17 B, 80100 Joensuu	Kauppakatu-Finland	IT and customer support	NA	a) User profile data: Name, address, email. IP address, unstructured data, employer, position. b) Unstructured personal data in tender documents (About supplier participating in bids

ADDITIONAL SERVICES OFFER BY MERCELL

Mercell Tender Project Management

NAME

LOCATION OF PROCESSING

DESCRIPTION OF PROCESSING

TRANSFER TOOL

COMMENT

TYPE OF DATA

iBinder reg. no 556573-1592,

Sweden

Ireland

Netherlands

Module for cloud-based information and document management for additional attachments of specific sizes. This module is sold separately, and it is only applicable to customers acquiring the service module.

Attachment documents and unstructured data included in the attachments

Ibinder subprocessor

Microsoft AB, including the sub-processors of Microsoft AB listed
in

https://www.microsoft.com/en-us/trustcenter/privacy/who-can-
access-your-data-and-on-what-terms

Attachment documents and unstructured data included in the attachments

Data Processing Agreement

Authorised sub-processors

Companies in the Mercell Group

We evolve procurement so you can evolve your business.