1. ETHICS

NAME 

LOCATION OF PROCESSING

DESCRIPTION OF PROCESSING

TRANSFER TOOL

COMMENT 

TYPE OF DATA

Atlassian Corporation Plc 

The data is stored in AWS in the EU (Ireland and Germany) 

Support ticket system external to the system

N/A

Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs. 

The data include profile information such as: Name, email address, organization, and job title. 


The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket. 

Mailjet SAS

Germany, Belgium, Bulgaria, France

Email deliverability platform for transactional email

   

Name, email, telephone numbers, IP address

Auth0 Inc.

Germany /USA(only for support tickets related to log-in that cannot be handled internally at Mercell, and this is informed to the customer case by case before transfering)

Authentication and authorization platform

Standard Contractual Clauses

Auth0 processes all personal data in the EU. In the case of support tickets, Mercell as processor, received the tickets, and in case  Mercell needs to involve Auth0 to resolve the issue. This ticket can be sent to Auth0 Inc.  The data is limited to IP address and email address to solve the issue. Mercell inform the customer before the transfer is conducted and provide a TIA that shows the technical and organizational measure taken for ensure a high level of protection.

Auth0 uses encryption of data, has strict access control rules, and follows the principle of data minimization.

Log in information 

Username

Email address

IP address

MongoDB Ltd

Germany, Ireland, France

Document-oriented database program, Data center hosting

   

a) User data for employees of the customer

b) Unstructured personal data in tender documents (About supplier

d) User data

e) Unstructured information in offers from suppliers that may contain

personal data, such as in the CV of employees or subcontractors who

included in the offer

Amazon Web Services EMEA SARL (AWS)

Germany/ Ireland 

E form Center hosting and subprocessor of MongoDB

   

a) User data for employees of the customer

b) Unstructured personal data in tender documents (About supplier

d) User data

e) Unstructured information in offers from suppliers that may contain

personal data, such as in the CV of employees or subcontractors who

included in the offer

 

  1. Negometrix3/Source-to-contract

 

NAME 

LOCATION OF PROCESSING

DESCRIPTION OF PROCESSING

TRANSFER TOOL

COMMENT 

TYPE OF DATA

Atlassian Corporation Plc

Data is stored in Amazon Web Services (AWS) in the EU (Ireland and Germany).

Processing of personal data related to support tickets raised regarding the use of Processor’s platform.

N/A

Support tickets are handled by a separate system (outside Processor’s platform).

Atlassian offers data encryption at rest and in transit, as well as a number of other security measures to safeguard the privacy of its users in case of data transfer for other aspects.

The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket.

The data usually includes profile information such as: name, email address, organization, and job title.

Microsoft Azure

Data is stored in Azure data centres in the Netherlands.

Hosting, backup, virtual machines

N/A

 

a) User data of user accounts for employees of the customer and (potential) supplier contacts

b) Unstructured personal data in documents added by users

Amazon Web Services

Data is stored in AWS data centres in Germany.

Hosting, backup, virtual machines and Data Center hosting for Notice editor

N/A

 

a) User data of user accounts for employees of the customer and (potential) supplier contacts

b) Unstructured personal data in documents added by users

Myracloud

Data is stored in data centres managed by Noris network, Equinix and Interxion in Germany and Austria.

DDOS protection

N/A

Only Myracloud employees have access to the data.

Name, e-mail address,
session id, cookie/cookie like data, IP-address

Messagebird

Data is stored in Google Cloud Platform in the EU (Belgium and The Netherlands).

SMS text service for users relying on single sign on

N/A

 

Mobile phone number, IP-address

Dmarcian

Data is stored in Google Cloud Platform in the EU (Belgium).

E-mail delivery security

N/A

 

E-mail address, IP-address

Mailjet SAS

Germany, Belgium, Bulgaria, France

Email deliverability platform for transactional email

   

Name, email, telephone numbers, IP address

 

 

  1. MERCELL TENDERING AND BIDDING

NAME 

LOCATION OF PROCESSING

DESCRIPTION OF PROCESSING

TRANSFER TOOL

COMMENT 

TYPE OF DATA

Amazon Web Services EMEA SARL (AWS)

Germany- Frankfurt

Data Center hosting 

NA

NA

a) User data

b) Supplier data information

c) Unstructured information in business document

Atlassian Corporation Plc 

The data is stored in AWS in the EU (Ireland and Germany) 

 

Support ticket system external to the system

NA

 

NA

The data include profile information such as Name, email address, organization, and job title. 

The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket.

Visma IT & Communications AS

Norway- Sweden

Digital signature

NA

Subprocessor applicable depending on customer selection

Name, Address, e-mail, job title 

 

DocuSign 

Germany, Ireland 

Digital signature

NA

Subprocessor applicable depending on customer selection

Name, Address, e-mail, job title 

Signicat AS

Netherlands/Finland

Digital signature

NA

Subprocessor applicable depending on customer selection

Name, Address, e-mail,  job title 

Whatfix

Germany/ Ireland

Onboard, train, and support users on the platform; Use also for improving support 

NA

NA

Name, Email id, Company Name, IP Address, Platform Activity Data

 

  1. MTS/MSS

NAME

LOCATION OF PROCESSING 

DESCRIPTION OF PROCESSING

TRANSFER TOOL

COMMENT

TYPE OF DATA

Atlassian Corporation Plc 

The data is stored in AWS in the EU (Ireland and Germany) 

Support ticket system external to the system

N/A

Support tickets are handled externally by the system. 

Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs. 


The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket

Amazon Web Services

Data is stored in AWS data centres in Germany.

Data Center hosting for Notice editor

 

 

Name, Email, Telephone

Signicat AS

Norway

Digital signature

N/A

 

Personal contact information (Name, Address, e-mail, phone number, etc.)

Inpadi ApS

Denmark

Hosting, Backup, Virtual Machines, 

N/A

 

a) User data for employees of the customer

b) Unstructured personal data in tender documents (About supplier

d) User data

e) Unstructured information in offers from suppliers that may contain

personal data, such as in the CV of employees or subcontractors who

included in the offer

 

  1. OPIC

 

NAME 

LOCATION OF PROCESSING

DESCRIPTION OF PROCESSING

TRANSFER TOOL

COMMENT 

TYPE OF DATA

Visma ITC AS 

Norway 

Norway – Hosting 

N/A

 

a) User data for employees of the customer

b) Unstructured personal data in tender documents (About supplier

d) User data

e) Unstructured information in offers from suppliers that may contain

personal data, such as in the CV of employees or subcontractors who included in the offer

Visma Labs SIA

Riga, Latvia

Software development

N/A

   

Atlassian Corporation Plc



The data is stored in AWS in the EU (Ireland and Germany) and the USA. 


Possible remote access from selected global countries where Atlassian operates. 

Support ticket  tool

NA









The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket.

The data usually includes profile information such as: name, email address, organization, and job title.

 

Amazon Web Services

Germany

Data Center hosting for Notice editor

N/A

 

Name, Email, Telephone

 

 

  1. P2P

NAME 

LOCATION OF PROCESSING

DESCRIPTION OF PROCESSING

COMMENT 

TYPE OF DATA

Amazon Web Services EMEA SARL (AWS)

Germany, Ireland 

Data Center hosting

 

a) User data

b) Supplier data information

c) Unstructured information in business document

Atlassian Corporation Plc 

The data is stored in AWS in the EU (Ireland and Germany) 

Support ticket system external to the system

Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs.

The data include profile information such as: Name, email address, organization, and job title. 


The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket.

ECIT

Poland

Invoice Scanning Services

Only relevant for Invoice/match customers + Norwegian customers.

Unstructured information in business document

Exadel GmbH

Germany, Spain

Software developing services

 

• Customer data

• Name

• Email addresses

• Support tickets

Mailgun

Germany, Belgium, Bulgaria, France

Email deliverability platform

 

Name, email

Miracle A/S

Denmark

Document integration services

 

Name, email, telephone number, delivery address, unstructured information on business documents

Tickstar AB

AWS Germany,  Ireland 

Document  delivery processing

Only relevant for Invoice/match customers + Norwegian customers.

Unstructured information in business document

Ubivox

Denmark, France the Netherlands 

Email deliverability platform

 

Name, email

WorldLine (former Bambora)

Germany, Ireland Sweden 

Payment service

Only relevant for P2P Webshop Customer
With credit card payment 

Name, payment credentials and order amount.

Zendesk

AWS Germany,   Ireland 

Support tickets

 

Historic support tickets. Content of the support ticket is limited to what the controller includes in such a support ticket



  1. ADDITIONAL SERVICES OFFER BY MERCELL; Mercell Tender Project Management

NAME

LOCATION OF PROCESSING

DESCRIPTION OF PROCESSING

TRANSFER TOOL

COMMENT

TYPE OF DATA

iBinder 


org. no 556573-1592,

Sweden

Ireland

Netherlands

Module for cloud-based information and document management for additional attachments of specific sizes. This module is sold separately, and it is only applicable to  customers acquiring the service module.

NA

 

Attachment documents and unstructured data included in the attachments

Ibinder subprocessor

Microsoft AB, including the sub-processors of Microsoft AB listed
in

https://www.microsoft.com/en-us/trustcenter/privacy/who-can-
Access-your-data-and-on-what-terms 

EU

Module for cloud-based information and document management for additional attachments of specific sizes. This module is sold separately, and it is only applicable to customers acquiring the service module.

NA

 

Attachment documents and unstructured data included in the attachments



  1. Companies in the Mercell Group

 

NAME

PLACE OF PROCESSING 

PROCESSING ACTIVITIES

TRANSFER TOOLS

TYPE OF DATA

COMMENTS

Cloudia Oy


Org. no. 1088146-2


Runeberginkatu 5 B 00100 Helsinki

Finland

Finland

IT and customer support

NA

a) User profile data: Name, address, email. IP address, unstructured data, employer, position.

b) Unstructured personal data in tender documents (About supplier participating in bids

c) Unstructured information in offers from suppliers that may contain

d) personal data, such as in the CV of employees or subcontractor included in the offer

 

EU supply limited


Org. no.

0851 3444


10 Queen Street Place

London EC4R 1AG

United Kingdom

London-UK

IT and customer support

Adequacy Decision

a) User profile data: Name, address, email. IP address, unstructured data, employer, position.

b) Unstructured personal data in tender documents (About supplier participating in bids

c) Unstructured information in offers from suppliers that may contain

d) personal data, such as in the CV of employees or subcontractor included in the offer

 

Mercell A/S


Org. no.

31261430


Vesterbrogade 149

1620 København V

Denmark

Copenhagen-Denmark

IT and customer support

NA

a) User profile data: Name, address, email. IP address, unstructured data, employer, position.

b) Unstructured personal data in tender documents (About supplier participating in bids

c) Unstructured information in offers from suppliers that may contain

d) personal data, such as in the CV of employees or subcontractor included in the offer

 

Mercell Danmark A/S


Org. no.

2569885135665897


Vesterbrogade 149 

1620 København

Denmark

Copenhagen-Denmark

IT and customer support

NA

a) User profile data: Name, address, email. IP address, unstructured data, employer, position.

b) Unstructured personal data in tender documents (About supplier participating in bids

c) Unstructured information in offers from suppliers that may contain

d) personal data, such as in the CV of employees or subcontractor included in the offer

 

Mercell Commerce AB


Org. no.

556533874501

 

Klara Södra kyrkogata 1

111 52 Stockholm

Sweden

Sweden Stockholm

IT and customer support

NA

a) User profile data: Name, address, email. IP address, unstructured data, employer, position.

b) Unstructured personal data in tender documents (About supplier participating in bids)

c) Unstructured information in offers from suppliers that may contain

d) personal data, such as in the CV of employees or subcontractor included in the offer

 

Mercell Nederland B.V.


Org. no.

30148169

 

Rijnzathe 32, 3454 PV Utrecht 

The Netherlands

Netherlands- Utrecht

IT and customer support

NA

a) User profile data: Name, address, email. IP address, unstructured data, employer, position.

b) Unstructured personal data in tender documents (About supplier participating in bids)

c) Unstructured information in offers from suppliers that may contain

d) personal data, such as in the CV of employees or subcontractor included in the offer

 

Mercell Holding  AS


Org. no.

980 921 565

Askekroken 11 

0277 Oslo

Norway

Oslo-Norway

IT and customer support

NA

a) User profile data: Name, address, email. IP address, unstructured data, employer, position.

b) Unstructured personal data in tender documents (About supplier participating in bids)

c) Unstructured information in offers from suppliers that may contain

d) personal data, such as in the CV of employees or subcontractor included in the offer

 

Mercell Norge AS


Org. no.

990 638 942

Askekroken 11 

0277 Oslo

Norway

Oslo-Norway

IT and customer support

NA

a) User profile data: Name, address, email. IP address, unstructured data, employer, position.

b) Unstructured personal data in tender documents (About supplier participating in bids)

c) Unstructured information in offers from suppliers that may contain

d) personal data, such as in the CV of employees or subcontractor included in the offer