Subprocessors & External Services

1. Different provider relationships

1.1A Company subprocessor handles Customer Personal Data for us in providing the Services. A Customer-Connected Service is independently contracted and configured by Customer. A Company module is our software, not a separate responsible legal entity. An available connector does not establish which of these relationships applies; the actual contract and data flow determine the role.

2. Supplier register

2.1The following register describes the Company’s suppliers and authorized service providers. A provider receives data only where the relevant feature, infrastructure or support activity uses that provider. Customer-connected accounts remain subject to the role distinctions below. Primary countries do not imply exclusive storage or exclude disclosed support access; service-specific contracting entities, applicable transfer safeguards and any additional access locations are recorded in the DPA schedule.

2.2Register version: September 25, 2026. Model access may be supplied by Company or through Customer’s own provider account; the actual contracting and processing arrangement determines the role. The service-specific schedule identifies the providers applicable to the purchased configuration.

2.3The legal identity and access scope of the appointed development contractors will be supplied to Customer as part of the service-specific DPA information, subject to appropriate confidentiality protections. Infrastructure access, debugging and remote support are processing activities even where the provider does not keep a separate database. The register is not an authorization for unrelated development use of production data.

3. Customer-connected providers

3.1Before connecting an account or API key, Customer must review the actual provider agreement, processing settings, permissions, prices and use restrictions. Model, voice, email, messaging and CRM providers may have different retention and training settings. Customer must not infer a provider’s terms from another provider’s policy.

3.2Claims about an independently supplied service are governed by the agreement with its provider. Nothing here guarantees a provider accepts liability or provides an indemnity, and nothing displaces the Company’s own obligations.

3.3Use of Customer’s own API key does not, by itself, determine the legal role of every participant. Where Company receives, stores, routes or logs Customer Personal Data in providing the connection, that handling remains subject to the DPA to the extent Company acts on Customer’s behalf. Customer’s separate provider agreement governs the processing performed under that provider relationship; it does not release Company from its own obligations.

4. Contact and changes

4.1Company will provide the applicable register and agreed notification route during onboarding. Requests for register information or notices concerning Company subprocessors may be sent to the agreed account contact or privacy@uniforce.work. Customer must keep its designated notice contact current; the Agreement and DPA govern effective delivery and applicable response periods.

5. Information in the service-specific register

5.1For each appointed subprocessor, the register identifies the legal entity, service purpose, relevant data categories and processing locations, including material remote-access locations. It also identifies the service configuration in which the provider is used and the applicable transfer safeguards. A group brand alone may be insufficient where different legal entities contract for different services.

5.2Only providers used for the purchased configuration receive relevant data. The service-specific schedule supplements this register with the contracting entity, permitted access and transfer safeguards; a provider brand does not replace those details.

5.3The assessment must include relevant affiliates and onward providers with access to Customer Personal Data, including access for support, maintenance or incident investigation. A provider need not operate a separate database to carry out processing. Company will obtain the information and contractual safeguards needed for its authorized processing chain under the DPA and applicable law, and make reasonably necessary chain information available to Customer subject to appropriate confidentiality protections.

6. Changes, objections and continuity

6.1For Company subprocessors, the notice and objection period in the DPA applies. A change notice identifies the new or replacement provider and affected processing so Customer can assess a reasonable data-protection concern. A silent edit to an inaccessible list is not a substitute for an agreed notice.

6.2Customer must describe the concern and affected use rather than treating every vendor update as an unrestricted cancellation right. Company will assess proportionate alternatives, such as another configuration or avoiding the affected processing. If no reasonable resolution is available, the DPA’s affected-service termination and unused-fee provisions apply.

6.3Customer-selected changes to its own provider accounts do not invoke the Company-subprocessor objection process. Customer must separately assess those changes and disconnect an incompatible service. Company must not reclassify a vendor it actually engages as Customer-selected solely to avoid its DPA obligations.

6.4Each change notice will identify the affected service, relevant provider, purpose, material processing or access locations, proposed effective date and route for submitting an objection. Company will retain a dated record of the register applicable to the contracted service and make it reasonably available for compliance review. Notice, objection and resolution deadlines are governed by the DPA; publication of a revised page does not shorten those deadlines.

7. Provider settings and independent terms

7.1The same provider may offer business, consumer, direct API and marketplace channels with different contracting entities, data uses and retention settings. Review the specific channel used by your connection. A no-training term is not a zero-retention term, and a provider’s security certification is not automatically a certification of Uniforce.

7.2Customer is responsible for its own provider billing, quota and access settings. A Company arrangement with an upstream provider does not automatically grant Customer a direct indemnity or right to enforce that arrangement. Company will honor the protections it grants in its own Agreement and cannot remove them merely by referring to upstream terms.

7.3Links to provider materials are informational unless expressly incorporated into the Agreement. A provider’s later policy change does not, by itself, amend Company’s commitments to Customer or authorize an expanded processing purpose. If a change prevents Company from meeting the agreed safeguards, Company must address the affected processing under the DPA rather than rely solely on the provider’s published terms.

8. AI provider use policies

8.1Customer and its authorized operators must follow the usage rules applicable to the enabled provider and product. These links identify official provider policies; they do not represent that every feature uses every provider. Product-specific API or cloud terms may impose additional requirements. A provider policy cannot amend Company’s DPA obligations or grant broader data-processing permission.