Sub-processor List

Version: 0.1-draft Effective date: not yet in force (draft) Status: Draft pending review by a qualified Romanian lawyer before use. Items marked [TBC] must be confirmed before publication.

1. About this list

1.1. ALTTAB PROFIT SRL (the "Company"), operator of the 1ads platform (the "Platform"), uses the sub-processors listed below to process Customer Data on behalf of its customers (each a "Customer"). This list forms part of Annex 3 to the Data Processing Agreement (data-processing-agreement.md, the "DPA"). Capitalised terms have the meaning given in the DPA and the Terms of Service (terms-of-service.md).

1.2. A sub-processor is a third party that the Company engages, as processor, to process personal data contained in Customer Data. Each sub-processor is bound by a written agreement with data protection obligations no less protective than those in the DPA, as required by Article 28(4) GDPR. The Company remains liable for its sub-processors.

1.3. The Platform's primary data store is located in the EU, on on-premises infrastructure in Romania. Where a sub-processor processes personal data outside the European Economic Area (EEA), the transfer is covered by one of the mechanisms in Chapter V GDPR, as shown in the tables and explained in Annex 4 to the DPA.

1.4. Some sub-processors are used only if the Customer enables the related feature or connector. They are listed separately in Section 4.

2. How we notify changes

2.1. Advance notice. At least 30 days before a new or replacement sub-processor starts processing Customer Personal Data, the Company:

(a) sends an email to the security incident and sub-processor notification contact named in Part B.2 of each Customer's Order Form (or, if none is named, to the Customer's account owner); and

(b) updates this page and the change log in Section 7.

2.2. Content of the notice. The notice states the sub-processor's name, location, the processing it will perform, the categories of data concerned and the transfer mechanism.

2.3. Additional recipients. Customers may add further recipients, such as their data protection officer, by writing to privacy@1ads.net with the subject "Sub-processor notifications".

2.4. Right to object. A Customer may object on reasonable data protection grounds within 30 days of the notice by writing to privacy@1ads.net. The procedure, including the right to terminate the affected service if no solution is found, is set out in Section 10.4 of the DPA. Agency Customers are responsible for passing notices on to their End Clients and relaying their objections.

2.5. Urgent replacements. If a sub-processor must be replaced urgently for security or service-continuity reasons, the Company notifies Customers as soon as possible, and the right to object still applies.

3. Core sub-processors

These sub-processors are used for every Customer.

Self-hosted components (not sub-processors). The Platform runs on the Company's own on-premises Kubernetes cluster in Romania. The following components run inside that infrastructure and are not operated by a third party, so they are not sub-processors: the PostgreSQL databases, the secrets store (HashiCorp Vault), the background job queue (graphile-worker, which runs on PostgreSQL), the identity provider for sign-in, single sign-on and multi-factor authentication (Keycloak, at auth.1ads.net), error tracking (self-hosted Sentry) and LLM observability (self-hosted Langfuse). The cluster is operated by the Company itself, under its FirstIT brand (FirstIT is a brand of the Company, not a separate legal entity), so there is no hosting sub-processor.

Single sign-on. Where a Customer uses single sign-on, the Platform's identity provider federates with the Customer's own identity provider (for example Okta, Microsoft Entra ID, Google Workspace or OneLogin). That identity provider is the Customer's own provider, chosen and contracted by the Customer, not a sub-processor of the Company (Section 6.1).

Notes on AI Providers.

• Anthropic. Under Anthropic's commercial terms, API inputs and outputs are not used to train models without the customer's express permission. The Company will not give that permission. According to Anthropic's published policies at the date of this list, API inputs and outputs are deleted within 30 days unless a zero data retention arrangement applies. Content flagged by Anthropic's automated trust and safety systems may be retained for up to 2 years, and data may be retained where the law requires it. Trust and safety classification scores may be kept for up to 7 years. Models that Anthropic designates as "Covered Models" require retention of at least 30 days and are generally not eligible for zero data retention; the Company will notify Customers under DPA Section 10 before using such a model for the AI Features. The Company has requested zero data retention. [TBC: status of the request.]
• OpenAI. According to OpenAI's published policies at the date of this list, data sent to the OpenAI API is not used to train OpenAI's models unless the customer opts in, and the Company has not opted in. Abuse-monitoring logs may be kept for up to 30 days unless OpenAI has approved zero data retention or modified abuse monitoring for the Company. [TBC: status.]

4. Optional sub-processors

These sub-processors are used only if the Customer enables the related feature or connector.

5. Data providers that do not receive Customer Personal Data

The Company buys public search, trend and news data from the providers below for Trend Radar and market analysis. The Company sends them queries (keywords, topics, markets and languages), not Customer Personal Data. Trending topics may occasionally name public figures. These providers are listed for transparency. If their role changes so that they would receive Customer Personal Data, the Company will follow the notice procedure in Section 2.

Other public trend sources used by Trend Radar (YouTube, Wikipedia, GDELT, news APIs, Bluesky and Mastodon) are accessed directly through their public interfaces. They are sources of public data, not sub-processors.

6. Who is not a sub-processor

6.1. Third-Party Platforms. The advertising platforms, analytics services, e-commerce and CRM systems and social networks that the Customer connects are the Customer's own providers or independent controllers. They are not sub-processors of the Company. Examples include Google (Google Ads, Google Analytics 4, Search Console, YouTube), Meta (Facebook, Instagram, Threads), TikTok, LinkedIn, Microsoft Advertising, Amazon Ads, Adobe Analytics, Shopify, WooCommerce, HubSpot, Salesforce, Pipedrive, X and Pinterest. The Customer's use of them is governed by its own agreements with their providers. The Company exchanges data with them only on the Customer's instruction. The same applies to the identity providers the Customer uses for single sign-on (for example Okta, Microsoft Entra ID, Google Workspace or OneLogin): they are the Customer's own providers, and the Platform only federates with them.

6.2. The Company's own providers as controller. Providers that the Company uses only for its own purposes as controller (for example accounting, banking, the RO e-Factura system and the website) are described in the Privacy Policy (privacy-policy.md).

7. Change log

8. Contact

Questions about this list: privacy@1ads.net. Data protection contact: {{DPO_CONTACT}}.