Providers & subprocessors

1. How to read this register

Global Data Intelligence Limited operates CompanyProof. A subprocessor handles customer personal data on our behalf when we are your processor. A supplier can instead be our processor for our own account administration, an independent controller, a data source, or a service you engage directly. Its role depends on the specific activity.

The inventory below identifies integrations present in the CompanyProof architecture and configuration. A provider receives data only for the function used. Inclusion is not a representation that every provider processes every customer’s submissions, that data stays in one country, or that every supplier contract has been independently audited.

Our Data-processing agreement governs authorisation and changes to subprocessors. A signed workflow schedule should identify the applicable legal entities, processing and support countries, downstream suppliers, transfer safeguards and any customer-specific exclusions. Ask for that schedule before committing to a residency requirement.

2. Service-provider inventory

Processing locations below describe known operating or transfer considerations, not a guarantee of a particular account’s hosting region. The contracted region and access locations must be established from the applicable order and supplier terms.

3. Upstream company data and AI processing

The upstream company-data provider’s supplier notice identifies Hetzner hosting in Germany and group-company support in Moldova for its own services. This is relevant upstream information; it does not, by itself, establish which of those entities receives CompanyProof customer content or prove a CompanyProof-specific transfer arrangement.

CompanyProof’s text-verification integration calls Regis AI. The application does not directly identify which model supplier Regis uses for a particular request. Do not assume that an unnamed model provider is excluded, that an AI request is processed only in the UK, or that a particular no-retention arrangement applies without the workflow schedule.

When customer content is processed under our DPA, we are responsible for the relevant authorised processing chain. Applicable onward-processing, confidentiality, security, retention, no-training and international-transfer terms must be established before that chain processes personal data outside the agreed instructions.

4. International transfers and supplier safeguards

Where a restricted international transfer occurs, an applicable adequacy route or valid contractual safeguard and any required supplementary measures must be in place. Depending on the transfer, this can include the EU Standard Contractual Clauses and the UK International Data Transfer Agreement or UK Addendum. A link to a supplier’s template is not evidence that it has been executed for your processing.

We must impose appropriate processing obligations on our subprocessors and remain responsible as set out in the DPA. Contact our privacy team for the relevant transfer mechanism, a safeguards summary and available supplier information. Copies may be redacted to protect confidential commercial or security information, without preventing legally required disclosures.

5. Subprocessor changes and objections

For customer processing governed by the DPA, we provide at least 30 days’ advance written notice of an intended addition or replacement of a subprocessor, using the customer’s designated privacy or account contact. Keep that contact current. Website publication supplements that notice; it does not replace a contractual requirement to notify you.

A customer may object within that period on reasonable, documented data-protection grounds. We will discuss a practicable alternative or safeguards. If the issue cannot be resolved before the affected processing begins, the DPA explains the right to end the affected service and receive any applicable refund of unused prepaid fees.

Changes to a supplier that acts only as an independent controller, or to a service you select directly, are not automatically a subprocessor change under our DPA. We still update relevant privacy information when our processing changes.

6. Services you choose

Your own AI assistant, MCP client, webhook destination, export recipient and connected systems are generally services you select and control. They are not our subprocessors merely because they connect to CompanyProof. You must establish their authority to receive the data and review their retention, security and model-training settings.

For a procurement review, send the intended workflow, data categories, required locations and supplier restrictions to our support team. For privacy or subprocessor objections, use our privacy team. Do not include production secrets or unnecessary personal data.