Authorised sub-processors

B.1. Approved sub-processors
On commencement of the Clauses, the data controller authorizes the engagement of the following sub-processors each table provides information of the subprocessor applicable for the related platform:

P2P

NAME  Location of processing DESCRIPTION OF PROCESSING COMMENT  TYPE OF DATA
Amazon Web Services EMEA SARL (AWS) Germany, Ireland Data Center hosting   a) User data
b) Supplier data information
c) Unstructured information in business document
Atlassian Corporation Plc The data is stored in AWS in the EU (Ireland and Germany) Support ticket system external to the system Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs. The data include profile information such as: Name, email address, organization, and job title. 

The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket.
ECIT Poland Invoice Scanning Services Only relevant for Invoice/match customers + Norwegian customers. Unstructured information in business document
Exadel GmbH Germany, Spain Software developing services   • Customer data
• Name
• Email addresses
• Support tickets
Mailgun Germany, Belgium, Bulgaria, France Email deliverability platform   Name, email
Miracle A/S Denmark Document integration services   Name, email, telephone number, delivery address, unstructured information on business documents
Tickstar AB AWS Germany,  Ireland Document  delivery processing Only relevant for Invoice/match customers + Norwegian customers. Unstructured information in business document
Ubivox Denmark, France the Netherlands Email deliverability platform   Name, email
WorldLine (former Bambora) Germany, Ireland Sweden Payment service Only relevant for P2P Webshop Customer
With credit card payment
Name, payment credentials and order amount.
Zendesk AWS Germany,   Ireland Support tickets   Historic support tickets. Content of the support ticket is limited to what the controller includes in such a support ticket

 

Opic

NAME LOCATION OF PROCESSING DESCRIPTION OF PROCESSING TRANSFER TOOL COMMENTS Type of Data process
Visma ITC AS Norway  Norway – Hosting  N/A   a) User data for employees of the customer
b) Unstructured personal data in tender documents (About supplier
d) User data
e) Unstructured information in offers from suppliers that may contain
personal data, such as in the CV of employees or subcontractors who included in the offer
Visma Labs SIA Riga, Latvia Software development N/A    
Atlassian Corporation Plc

The data is stored in AWS in the EU (Ireland and Germany) and the USA. 

Possible remote access from selected global countries where Atlassian operates. 
Support ticket  tool NA   The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket.
The data usually includes profile information such as: name, email address, organization, and job title.
Amazon Web Services Germany. Data Center hosting for Notice editor N/A   Name, Email, Telephone

 

 

MTS/MSS

NAME LOCATION OF PROCESSING  DESCRIPTION OF PROCESSING TRANSFER TOOL COMMENT Type of data
Atlassian Corporation Plc  The data is stored in AWS in the EU (Ireland and Germany)  Support ticket system external to the system N/A Support tickets are handled externally by the system. 
Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs. 

The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket
Amazon Web Services Data is stored in AWS data centres in Germany. Data Center hosting for Notice editor     Name, Email, Telephone
Signicat AS Norway Digital signature N/A   Personal contact information (Name, Address, e-mail, phone number, etc.)
Inpadi ApS Denmark Hosting, Backup, Virtual Machines,  N/A   a) User data for employees of the customer
b) Unstructured personal data in tender documents (About supplier
d) User data
e) Unstructured information in offers from suppliers that may contain
personal data, such as in the CV of employees or subcontractors who
included in the offer

 

Negometrix3/Source-to-contract

NAME LOCATION OF PROCESSING DESCRIPTION OF PROCESSING TRANSFER TOOL COMMENT Type of date
Atlassian Corporation Plc Data is stored in Amazon Web Services (AWS) in the EU (Ireland and Germany). Processing of personal data related to support tickets raised regarding the use of Processor’s platform. N/A Support tickets are handled by a separate system (outside Processor’s platform).
Atlassian offers data encryption at rest and in transit, as well as a number of other security measures to safeguard the privacy of its users in case of data transfer for other aspects.
The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket.
The data usually includes profile information such as: name, email address, organization, and job title.
Microsoft Azure Data is stored in Azure data centres in the Netherlands. Hosting, backup, virtual machines N/A   a) User data of user accounts for employees of the customer and (potential) supplier contacts
b) Unstructured personal data in documents added by users
Amazon Web Services Data is stored in AWS data centres in Germany. Hosting, backup, virtual machines and Data Center hosting for Notice editor N/A   a) User data of user accounts for employees of the customer and (potential) supplier contacts
b) Unstructured personal data in documents added by users
Myracloud Data is stored in data centres managed by Noris network, Equinix and Interxion in Germany and Austria. DDOS protection N/A Only Myracloud employees have access to the data. Name, e-mail address,
session id, cookie/cookie like data, IP-address
Messagebird Data is stored in Google Cloud Platform in the EU (Belgium and The Netherlands). SMS text service for users relying on single sign on N/A   Mobile phone number, IP-address
Dmarcian Data is stored in Google Cloud Platform in the EU (Belgium). E-mail delivery security N/A   E-mail address, IP-address
Mailjet Data is stored in Google Cloud data centres in the Netherlands and Belgium E-mail automation  N/A   Name, e-mail address, IP address

 

ETHICS

NAME  Location of processing  DESCRIPTION OF PROCESSING TRANSFER TOOL COMMENT  TYPE OD DATA
Atlassian Corporation Plc  The data is stored in AWS in the EU (Ireland and Germany)  Support ticket system external to the system N/A Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs.   The data include profile information such as: Name, email address, organization, and job title. 

The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket. 
Mailjet SAS Germany, Belgium, Bulgaria, France Email deliverability platform for transactional email     Name, email, telephone numbers, IP address
Auth0 Inc. Germany /USA(only for support tickets related to log-in that cannot be handled internally at Mercell, and this is informed to the customer case by case before transfering) Authentication and authorization platform Standard Contractual Clauses Auth0 processes all personal data in the EU. In the case of support tickets, Mercell as processor, received the tickets, and in case  Mercell needs to involve Auth0 to resolve the issue. This ticket can be sent to Auth0 Inc.  The data is limited to IP address and email address to solve the issue. Mercell inform the customer before the transfer is conducted and provide a TIA that shows the technical and organizational measure taken for ensure a high level of protection.
Auth0 uses encryption of data, has strict access control rules, and follows the principle of data minimization.
Log in information 
Username
Email address
IP address
MongoDB Ltd Germany, Ireland, France Document-oriented database program, Data center hosting     a) User data for employees of the customer
b) Unstructured personal data in tender documents (About supplier
d) User data
e) Unstructured information in offers from suppliers that may contain
personal data, such as in the CV of employees or subcontractors who
included in the offer
Amazon Web Services EMEA SARL (AWS) Germany/ Ireland  E form Center hosting and subprocessor of MongoDB     a) User data for employees of the customer
b) Unstructured personal data in tender documents (About supplier
d) User data
e) Unstructured information in offers from suppliers that may contain
personal data, such as in the CV of employees or subcontractors who
included in the offer

 

CTM

NAME LOCATION OF PROCESSING DESCRIPTION OF PROCESSING TRANSFER TOOL COMMENT Type of date
Atlassian Corporation Plc  The data is stored in AWS in the EU (Ireland and Germany)  Support ticket system external to the system N/A Support tickets are handled externally of the system. 

Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs. 
 The data include profile information such as Name, email address, organization, and job title. 

The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket. 
Signicat AS Norway Digital signature N/A   Personal contact information (Name, Address, e-mail, phone number, etc.)
Amazon Web Services Data is stored in AWS data centres in Germany. Data Center hosting for Notice editor     Name, Email, Telephone

 

Cloudia

NAME  Location of processing  DESCRIPTION OF PROCESSING TRANSFER TOOL COMMENT  TYPE OF DATA
Atlassian Corporation Plc  The data is stored in AWS in the EU (Ireland and Germany)  Support ticket system external to the system N/A
Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs. 
 The data include profile information such as: Name, email address, organization, and job title. 

The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket. 
Amazon Web Services Data is stored in AWS data centres in Germany. Data Center hosting for Notice editor N/A N/A Name, Email, Telephone
Equinix Finland Document-oriented database program, Data center hosting N/A N/A a) User data for employees of the customer
b) Unstructured personal data in tender documents (About supplier
d) User data
e) Unstructured information in offers from suppliers that may contain
personal data, such as in the CV of employees or subcontractors who
included in the offer
Zendesk AWS Germany,   Ireland  Support tickets N/A Historic support tickets. Content of the support ticket is limited to what the controller includes in such a support ticket N/A

 

Udbudsvagten

NAME  Location of processing  DESCRIPTION OF PROCESSING COMMENT  TYPE OF DATA
Amazon Web Services EMEA SARL (AWS) Germany, Ireland  Data Center hosting N/A a) User data
b) Supplier data information
c) Unstructured information in business document
Atlassian Corporation Plc  The data is stored in AWS in the EU (Ireland and Germany)  Support ticket system external to the system Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs.

Atlassian offers data encryption at rest and in transit, as well as a number of other security measures to safeguard the privacy of its users in case of data transfer for other aspects. 
The data include profile information such as: Name, email address, organization, and job title. 

The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket.
Auth0 Inc. Germany /USA(only for support tickets related to log-in that cannot be handled internally at Mercell, and this is informed to the customer case by case before transfering) Authentication and authorization platform Auth0 processes all personal data in the EU. In the case of support tickets, Mercell as processor, received the tickets, and in case  Mercell needs to involve Auth0 to resolve the issue. This ticket can be sent to Auth0 Inc.  The data is limited to IP address and email address to solve the issue. Mercell inform the customer before the transfer is conducted and provide a TIA that shows the technical and organizational measure taken for ensure a high level of protection.
Auth0 uses encryption of data, has strict access control rules, and follows the principle of data minimization.

The transfer of data they use are SCC
Standard Contractual Clauses
Log in information 
Username
Email address
IP address
Datadog Germany Monitoring for Support, troubleshooting of the technical infrastructure N/A N/A

 

Comcare

NAME  Location of processing  DESCRIPTION OF PROCESSING COMMENT  TYPE OD DATA
Atlassian Corporation Plc  The data is stored in AWS in the EU (Ireland and Germany)  Support ticket system external to the system  Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs.

Atlassian offers data encryption at rest and in transit, as well as a number of other security measures to safeguard the privacy of its users in case of data transfer for other aspects. 
The data include profile information such as: Name, email address, organization, and job title. 

The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket.
Awexi Denmark Data Center hosting Phisical a) User data
b) Supplier data information
c) Unstructured information in business document
Exadel GmbH Germany, Spain Software developing sevices   • Customer data
• Name
• Email addresses
• Support tickets

 

Truelink/Truetrade/TrueAnalysis

NAME  Location of processing  DESCRIPTION OF PROCESSING COMMENT  TYPE OF DATA
Atlassian Corporation Plc  The data is stored in AWS in the EU (Ireland and Germany)  Support ticket system external to the system Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs.

Atlassian offers data encryption at rest and in transit, as well as a number of other security measures to safeguard the privacy of its users in case of data transfer for other aspects. 
The data include profile information such as: Name, email address, organization, and job title. 

The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket.
Microsoft Inc. Amsterdam, The Netherlands Data Center Hosting Azure Kubernetes Services, Azure Storage a) User data
b) Supplier data information
c) Unstructured information in business document
ScanNet Denmark Vsphere
Veeam Cloud Connect
Tivoli Storage Manager
ScanNet is a hosting provider with 3 physical servers, dedicated to TrueLink, on which more than 30 virtual machines are running under control of the Vsphere software.

All virtual machines are backuped on VM level each night as a image snapshot to external service Veeam Cloud Connect

All virtual machines file system is backuped per file each night to external service Tivoli Storage Manager, additionally transaction logs from databases are shipped there on the fly
All data, which processed by all 3 platforms:
• Customer data
• Supplier data
• Unstructured information in documents

 

Tendsign

NAME  LOCATION OF PROCESSING DESCRIPTION OF PROCCESSING COMMENT  TYPE OF DATA
Visma IT & Communications AS

556438-3544
Oslo / Norge N/A Lagring på servrar Visma IT & Communications AS

556438-3544
Creditsafe i Sverige AB

556514-4408
Sverige N/A Kreditupplysning Creditsafe i Sverige AB

556514-4408
Chambersign i Sverige AB

559037-9029
Sverige N/A Digital signering Chambersign i Sverige AB

559037-9029
TwoDay A/S (Addo)

VAT:DK29973334
Danmark N/A Digital signering TwoDay A/S (Addo)

VAT:DK29973334
TwoDay AB

556117-7543
Sverige N/A Arkivering/inloggning TwoDay AB

556117-7543
TwoDay UAB

VAT:LT100006193618
Litauen N/A Utveckling/underhåll/support  TwoDay UAB

VAT:LT100006193618
Atlassian Jira Germany N/A Kundportal för supportfrågor Atlassian Jira
Amazon Web Services EMEA SARL
908705
Germany
Frankfurt
N/A Data Center
hosting for Notice editor
Amazon Web Services EMEA SARL
908705
         

 

MERCELL APP

NAME LOCATION OF PROCESSING DESCRIPTION OF PROCESSING TRANSFER TOOL COMMENT Type of data
Atlassian Corporation Plc  The data is stored in AWS in the EU (Ireland and Germany)  Support ticket system external to the system N/A Support tickets are handled externally of the system. 

Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs. 
 The data include profile information such as Name, email address, organization, and job title. 

The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket.
Amazon Web Services Germany-Frankfur, Ireland-Dublin Data Center hosting and email-sending tool N/A email sending functionality  is also conducted from AWS
Login is also done from the AWS
Name, Email, Telephone, unstructured data. 

 

 

ADDITIONAL SERVICES OFFER BY MERCELL

Mercell Tender Project Management

NAME LOCATION OF PROCESSING DESCRIPTION OF PROCESSING TRANSFER TOOL COMMENT TYPE OF DATA
iBinder reg. no 556573-1592,

Sweden

Ireland

Netherlands

Module for cloud-based information and document management for additional attachments of specific sizes. This module is sold separately, and it is only applicable to  customers acquiring the service module. NA   Attachment documents and unstructured data included in the attachments

Ibinder subprocessor

Microsoft AB, including the sub-processors of Microsoft AB listed
in

https://www.microsoft.com/en-us/trustcenter/privacy/who-can-
access-your-data-and-on-what-terms

EU Module for cloud-based information and document management for additional attachments of specific sizes. This module is sold separately, and it is only applicable to customers acquiring the service module. NA   Attachment documents and unstructured data included in the attachments