Every third party we use to process personal data on your behalf — what they do, what data they touch, where they're located, and how the transfer is safeguarded.
This list exists to satisfy Article 13(1)(f) of the GDPR directly — not just to say safeguards exist, but to name who they're with. We keep it current and update the date below whenever it changes.
If we add a new sub-processor, we will update this list and, for clients with a Data Processing Agreement in place, give notice before the change takes effect, consistent with the objection right described in that agreement.
| Sub-processor | Purpose | Data Categories | Location | Transfer Mechanism |
|---|---|---|---|---|
| Google Ireland Limited (Firebase / Google Cloud Platform) | Authentication, database, file storage, and hosting for the Member Portal (portal.nordicriser.com) | Account credentials, profile data, uploaded document contents, secure message content, case and payment records | Google Cloud infrastructure — specific processing region pending internal confirmation (see note below) | Google Cloud's Cloud Data Processing Addendum, incorporating the European Commission's Standard Contractual Clauses |
| DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) | AI-generated risk, cost, and productivity analysis in NR-BOS (optional feature) | Project and company names, budget figures, task details, cost entries, full names and roles of assigned team members | China | Standard Contractual Clauses (controller-to-processor module). China has no European Commission adequacy decision — see Privacy Policy Section 6.4 for the full disclosure |
| PostgreSQL database (NR-BOS) | Core relational data storage — users, companies, projects, tasks, cost entries, field reports, license records | Broad — effectively all NR-BOS operational data, including personal data of client company staff | Pending internal confirmation | Pending internal confirmation |
| Object storage, S3-compatible (NR-BOS) | Worksite photograph storage and generated PDF client reports | Photograph files (may include camera-embedded EXIF such as GPS coordinates or a timestamp), PDF report documents | Pending internal confirmation | Pending internal confirmation |
| Translation API provider (Global Reach) | Real-time translation of chat messages in Global Reach's collaboration rooms | Chat message content | Pending internal confirmation | Pending internal confirmation |
Rows marked “pending internal confirmation” are confirmed to exist and to receive the stated data category — we verified this directly against our own source code before publishing this table. What isn't yet finalised is the exact hosting vendor and region for three of them. We are listing them rather than omitting them because Article 13(1)(f) requires disclosing the transfers we make, not only the ones we've fully documented, and because leaving a known gap off this table would be less honest than flagging it plainly. We will complete these entries and update the date above as soon as they're confirmed.