Sub-processors

To provide a secure, fast, and automated infrastructure service, Geogiraph (The Insiders Hub AB) uses third-party vendors for certain technical functions. When these vendors process personal data where our customers are the data controllers, they act as sub-processors to us.

List of Approved Sub-processors

Google Cloud EMEA Limited

• Type of service: Hosting, database (Firestore), file storage (Cloud Storage), serverless compute (Cloud Run) as well as build and scheduling.
• Relevant Geogiraph feature: Core infrastructure, server operations, and secure storage for the Service.
• Address details: 70 Sir John Rogerson's Quay, Dublin 2, Ireland.
• Data categories: All customer data in the Service: company data, employee details (name, role), uploaded documents (e.g., LinkedIn export, verification documents), contact details.
• Data processed in: EU (Finland [europe-north1] and Belgium [europe-west1]).

Google Cloud EMEA Limited (Vertex AI)

• Type of service: AI reasoning, classification, and named-entity recognition (NER) across customer content. Configured via Enterprise terms so that data is not used to train the provider's public models (in accordance with DPA §7.1).
• Relevant Geogiraph feature: Automated verification, analysis, and extraction of personal names from AI engine outputs.
• Address details: 70 Sir John Rogerson's Quay, Dublin 2, Ireland.
• Data categories: Content text that may contain personal data (e.g., names in documents and emails).
• Data processed in: EU (Belgium [europe-west1] and Netherlands [europe-west4]).

Sendinblue SAS (Brevo)

• Corporate identity number: 498 019 298 R.C.S. Paris
• Type of service: Sending of transactional emails.
• Relevant Geogiraph feature: Distribution of installation kits and reports from the system to the Customer.
• Address details: 17 rue de Salneuve, 75017 Paris, France.
• Data categories: Recipient's email address, name, and email content.
• Data processed in: EU (France).

Services That Are Not Sub-processors

The following are integrated into the service but do not process the customer's personal data on our behalf:

• AI probe engines (OpenAI/ChatGPT, Anthropic/Claude, Perplexity in the US; Gemini/Mistral in the EU) – These only receive a public payload (company name + generic query) to measure AI visibility. Company names for legal entities do not constitute personal data (DPA §7.2), and the engines' responses are processed internally within the EU. No customer personal data is sent there.
• External data sources (GLEIF, Wikidata, RSS/job feeds, websites, TED [the EU public procurement database], Wikipedia.org) – We retrieve public data from these sources; we do not send the customer's personal data to them. GLEIF/Wikidata only receive company identifiers and the company name.

Objections: Objections should be sent via email to privacy@geogiraph.com. Please include your company name, contract reference, and the specific data protection arguments on which the objection is based.