Authorised sub-processors
B.1. Approved sub-processors
On commencement of the Clauses, the data controller authorizes the engagement of the following sub-processors each table provides information of the subprocessor applicable for the related platform:
P2P
NAME | Location of processing | DESCRIPTION OF PROCESSING | COMMENT | TYPE OF DATA |
Amazon Web Services EMEA SARL (AWS) | Germany, Ireland | Data Center hosting | a) User data b) Supplier data information c) Unstructured information in business document |
|
Atlassian Corporation Plc | The data is stored in AWS in the EU (Ireland and Germany) | Support ticket system external to the system | Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs. | The data include profile information such as: Name, email address, organization, and job title. The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket. |
ECIT | Poland | Invoice Scanning Services | Only relevant for Invoice/match customers + Norwegian customers. | Unstructured information in business document |
Exadel GmbH | Germany, Spain | Software developing services | • Customer data • Name • Email addresses • Support tickets |
|
Mailgun | Germany, Belgium, Bulgaria, France | Email deliverability platform | Name, email | |
Miracle A/S | Denmark | Document integration services | Name, email, telephone number, delivery address, unstructured information on business documents | |
Tickstar AB | AWS Germany, Ireland | Document delivery processing | Only relevant for Invoice/match customers + Norwegian customers. | Unstructured information in business document |
Ubivox | Denmark, France the Netherlands | Email deliverability platform | Name, email | |
WorldLine (former Bambora) | Germany, Ireland Sweden | Payment service | Only relevant for P2P Webshop Customer With credit card payment |
Name, payment credentials and order amount. |
Zendesk | AWS Germany, Ireland | Support tickets | Historic support tickets. Content of the support ticket is limited to what the controller includes in such a support ticket |
Opic
NAME | LOCATION OF PROCESSING | DESCRIPTION OF PROCESSING | TRANSFER TOOL | COMMENTS | Type of Data process |
Visma ITC AS | Norway | Norway – Hosting | N/A | a) User data for employees of the customer b) Unstructured personal data in tender documents (About supplier d) User data e) Unstructured information in offers from suppliers that may contain personal data, such as in the CV of employees or subcontractors who included in the offer |
|
Visma Labs SIA | Riga, Latvia | Software development | N/A | ||
Atlassian Corporation Plc |
The data is stored in AWS in the EU (Ireland and Germany) and the USA. Possible remote access from selected global countries where Atlassian operates. |
Support ticket tool | NA | The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket. The data usually includes profile information such as: name, email address, organization, and job title. |
|
Amazon Web Services | Germany. | Data Center hosting for Notice editor | N/A | Name, Email, Telephone |
MTS/MSS
NAME | LOCATION OF PROCESSING | DESCRIPTION OF PROCESSING | TRANSFER TOOL | COMMENT | Type of data |
Atlassian Corporation Plc | The data is stored in AWS in the EU (Ireland and Germany) | Support ticket system external to the system | N/A | Support tickets are handled externally by the system. Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs. |
The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket |
Amazon Web Services | Data is stored in AWS data centres in Germany. | Data Center hosting for Notice editor | Name, Email, Telephone | ||
Signicat AS | Norway | Digital signature | N/A | Personal contact information (Name, Address, e-mail, phone number, etc.) | |
Inpadi ApS | Denmark | Hosting, Backup, Virtual Machines, | N/A | a) User data for employees of the customer b) Unstructured personal data in tender documents (About supplier d) User data e) Unstructured information in offers from suppliers that may contain personal data, such as in the CV of employees or subcontractors who included in the offer |
Negometrix3/Source-to-contract
NAME | LOCATION OF PROCESSING | DESCRIPTION OF PROCESSING | TRANSFER TOOL | COMMENT | Type of date |
Atlassian Corporation Plc | Data is stored in Amazon Web Services (AWS) in the EU (Ireland and Germany). | Processing of personal data related to support tickets raised regarding the use of Processor’s platform. | N/A | Support tickets are handled by a separate system (outside Processor’s platform). Atlassian offers data encryption at rest and in transit, as well as a number of other security measures to safeguard the privacy of its users in case of data transfer for other aspects. |
The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket. The data usually includes profile information such as: name, email address, organization, and job title. |
Microsoft Azure | Data is stored in Azure data centres in the Netherlands. | Hosting, backup, virtual machines | N/A | a) User data of user accounts for employees of the customer and (potential) supplier contacts b) Unstructured personal data in documents added by users |
|
Amazon Web Services | Data is stored in AWS data centres in Germany. | Hosting, backup, virtual machines and Data Center hosting for Notice editor | N/A | a) User data of user accounts for employees of the customer and (potential) supplier contacts b) Unstructured personal data in documents added by users |
|
Myracloud | Data is stored in data centres managed by Noris network, Equinix and Interxion in Germany and Austria. | DDOS protection | N/A | Only Myracloud employees have access to the data. | Name, e-mail address, session id, cookie/cookie like data, IP-address |
Messagebird | Data is stored in Google Cloud Platform in the EU (Belgium and The Netherlands). | SMS text service for users relying on single sign on | N/A | Mobile phone number, IP-address | |
Dmarcian | Data is stored in Google Cloud Platform in the EU (Belgium). | E-mail delivery security | N/A | E-mail address, IP-address | |
Mailjet | Data is stored in Google Cloud data centres in the Netherlands and Belgium | E-mail automation | N/A | Name, e-mail address, IP address |
ETHICS
NAME | Location of processing | DESCRIPTION OF PROCESSING | TRANSFER TOOL | COMMENT | TYPE OD DATA |
Atlassian Corporation Plc | The data is stored in AWS in the EU (Ireland and Germany) | Support ticket system external to the system | N/A | Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs. | The data include profile information such as: Name, email address, organization, and job title. The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket. |
Mailjet SAS | Germany, Belgium, Bulgaria, France | Email deliverability platform for transactional email | Name, email, telephone numbers, IP address | ||
Auth0 Inc. | Germany /USA(only for support tickets related to log-in that cannot be handled internally at Mercell, and this is informed to the customer case by case before transfering) | Authentication and authorization platform | Standard Contractual Clauses | Auth0 processes all personal data in the EU. In the case of support tickets, Mercell as processor, received the tickets, and in case Mercell needs to involve Auth0 to resolve the issue. This ticket can be sent to Auth0 Inc. The data is limited to IP address and email address to solve the issue. Mercell inform the customer before the transfer is conducted and provide a TIA that shows the technical and organizational measure taken for ensure a high level of protection. Auth0 uses encryption of data, has strict access control rules, and follows the principle of data minimization. |
Log in information Username Email address IP address |
MongoDB Ltd | Germany, Ireland, France | Document-oriented database program, Data center hosting | a) User data for employees of the customer b) Unstructured personal data in tender documents (About supplier d) User data e) Unstructured information in offers from suppliers that may contain personal data, such as in the CV of employees or subcontractors who included in the offer |
||
Amazon Web Services EMEA SARL (AWS) | Germany/ Ireland | E form Center hosting and subprocessor of MongoDB | a) User data for employees of the customer b) Unstructured personal data in tender documents (About supplier d) User data e) Unstructured information in offers from suppliers that may contain personal data, such as in the CV of employees or subcontractors who included in the offer |
CTM
NAME | LOCATION OF PROCESSING | DESCRIPTION OF PROCESSING | TRANSFER TOOL | COMMENT | Type of date |
Atlassian Corporation Plc | The data is stored in AWS in the EU (Ireland and Germany) | Support ticket system external to the system | N/A | Support tickets are handled externally of the system. Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs. |
The data include profile information such as Name, email address, organization, and job title. The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket. |
Signicat AS | Norway | Digital signature | N/A | Personal contact information (Name, Address, e-mail, phone number, etc.) | |
Amazon Web Services | Data is stored in AWS data centres in Germany. | Data Center hosting for Notice editor | Name, Email, Telephone |
Cloudia
NAME | Location of processing | DESCRIPTION OF PROCESSING | TRANSFER TOOL | COMMENT | TYPE OF DATA |
Atlassian Corporation Plc | The data is stored in AWS in the EU (Ireland and Germany) | Support ticket system external to the system | N/A | Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs. |
The data include profile information such as: Name, email address, organization, and job title. The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket. |
Amazon Web Services | Data is stored in AWS data centres in Germany. | Data Center hosting for Notice editor | N/A | N/A | Name, Email, Telephone |
Equinix | Finland | Document-oriented database program, Data center hosting | N/A | N/A | a) User data for employees of the customer b) Unstructured personal data in tender documents (About supplier d) User data e) Unstructured information in offers from suppliers that may contain personal data, such as in the CV of employees or subcontractors who included in the offer |
Zendesk | AWS Germany, Ireland | Support tickets | N/A | Historic support tickets. Content of the support ticket is limited to what the controller includes in such a support ticket | N/A |
Udbudsvagten
NAME | Location of processing | DESCRIPTION OF PROCESSING | COMMENT | TYPE OF DATA |
Amazon Web Services EMEA SARL (AWS) | Germany, Ireland | Data Center hosting | N/A | a) User data b) Supplier data information c) Unstructured information in business document |
Atlassian Corporation Plc | The data is stored in AWS in the EU (Ireland and Germany) | Support ticket system external to the system | Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs. Atlassian offers data encryption at rest and in transit, as well as a number of other security measures to safeguard the privacy of its users in case of data transfer for other aspects. |
The data include profile information such as: Name, email address, organization, and job title. The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket. |
Auth0 Inc. | Germany /USA(only for support tickets related to log-in that cannot be handled internally at Mercell, and this is informed to the customer case by case before transfering) | Authentication and authorization platform | Auth0 processes all personal data in the EU. In the case of support tickets, Mercell as processor, received the tickets, and in case Mercell needs to involve Auth0 to resolve the issue. This ticket can be sent to Auth0 Inc. The data is limited to IP address and email address to solve the issue. Mercell inform the customer before the transfer is conducted and provide a TIA that shows the technical and organizational measure taken for ensure a high level of protection. Auth0 uses encryption of data, has strict access control rules, and follows the principle of data minimization. The transfer of data they use are SCC Standard Contractual Clauses |
Log in information Username Email address IP address |
Datadog | Germany | Monitoring for Support, troubleshooting of the technical infrastructure | N/A | N/A |
Comcare
NAME | Location of processing | DESCRIPTION OF PROCESSING | COMMENT | TYPE OD DATA |
Atlassian Corporation Plc | The data is stored in AWS in the EU (Ireland and Germany) | Support ticket system external to the system | Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs. Atlassian offers data encryption at rest and in transit, as well as a number of other security measures to safeguard the privacy of its users in case of data transfer for other aspects. |
The data include profile information such as: Name, email address, organization, and job title. The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket. |
Awexi | Denmark | Data Center hosting | Phisical | a) User data b) Supplier data information c) Unstructured information in business document |
Exadel GmbH | Germany, Spain | Software developing sevices | • Customer data • Name • Email addresses • Support tickets |
Truelink/Truetrade/TrueAnalysis
NAME | Location of processing | DESCRIPTION OF PROCESSING | COMMENT | TYPE OF DATA |
Atlassian Corporation Plc | The data is stored in AWS in the EU (Ireland and Germany) | Support ticket system external to the system | Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs. Atlassian offers data encryption at rest and in transit, as well as a number of other security measures to safeguard the privacy of its users in case of data transfer for other aspects. |
The data include profile information such as: Name, email address, organization, and job title. The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket. |
Microsoft Inc. | Amsterdam, The Netherlands | Data Center Hosting | Azure Kubernetes Services, Azure Storage | a) User data b) Supplier data information c) Unstructured information in business document |
ScanNet | Denmark | Vsphere Veeam Cloud Connect Tivoli Storage Manager |
ScanNet is a hosting provider with 3 physical servers, dedicated to TrueLink, on which more than 30 virtual machines are running under control of the Vsphere software. All virtual machines are backuped on VM level each night as a image snapshot to external service Veeam Cloud Connect All virtual machines file system is backuped per file each night to external service Tivoli Storage Manager, additionally transaction logs from databases are shipped there on the fly |
All data, which processed by all 3 platforms: • Customer data • Supplier data • Unstructured information in documents |
Tendsign
NAME | LOCATION OF PROCESSING | DESCRIPTION OF PROCCESSING | COMMENT | TYPE OF DATA |
Visma IT & Communications AS 556438-3544 |
Oslo / Norge | N/A | Lagring på servrar | Visma IT & Communications AS 556438-3544 |
Creditsafe i Sverige AB 556514-4408 |
Sverige | N/A | Kreditupplysning | Creditsafe i Sverige AB 556514-4408 |
Chambersign i Sverige AB 559037-9029 |
Sverige | N/A | Digital signering | Chambersign i Sverige AB 559037-9029 |
TwoDay A/S (Addo) VAT:DK29973334 |
Danmark | N/A | Digital signering | TwoDay A/S (Addo) VAT:DK29973334 |
TwoDay AB 556117-7543 |
Sverige | N/A | Arkivering/inloggning | TwoDay AB 556117-7543 |
TwoDay UAB VAT:LT100006193618 |
Litauen | N/A | Utveckling/underhåll/support | TwoDay UAB VAT:LT100006193618 |
Atlassian Jira | Germany | N/A | Kundportal för supportfrågor | Atlassian Jira |
Amazon Web Services EMEA SARL 908705 |
Germany Frankfurt |
N/A | Data Center hosting for Notice editor |
Amazon Web Services EMEA SARL 908705 |
MERCELL APP
NAME | LOCATION OF PROCESSING | DESCRIPTION OF PROCESSING | TRANSFER TOOL | COMMENT | Type of data |
Atlassian Corporation Plc | The data is stored in AWS in the EU (Ireland and Germany) | Support ticket system external to the system | N/A | Support tickets are handled externally of the system. Support ticket content is hosted in the EU. Personal contact data submitted when creating a support ticket is normally limited to customer inputs. |
The data include profile information such as Name, email address, organization, and job title. The personal data included in the content of the support ticket is limited to what the controller includes in such a support ticket. |
Amazon Web Services | Germany-Frankfur, Ireland-Dublin | Data Center hosting and email-sending tool | N/A | email sending functionality is also conducted from AWS Login is also done from the AWS |
Name, Email, Telephone, unstructured data. |
ADDITIONAL SERVICES OFFER BY MERCELL
Mercell Tender Project Management
NAME | LOCATION OF PROCESSING | DESCRIPTION OF PROCESSING | TRANSFER TOOL | COMMENT | TYPE OF DATA |
iBinder reg. no 556573-1592, |
Sweden Ireland Netherlands |
Module for cloud-based information and document management for additional attachments of specific sizes. This module is sold separately, and it is only applicable to customers acquiring the service module. | NA | Attachment documents and unstructured data included in the attachments | |
Ibinder subprocessor Microsoft AB, including the sub-processors of Microsoft AB listed |
EU | Module for cloud-based information and document management for additional attachments of specific sizes. This module is sold separately, and it is only applicable to customers acquiring the service module. | NA | Attachment documents and unstructured data included in the attachments |