Sub Processors List LoyJoy GmbH GDPR Compliance – LoyJoy

LoyJoy GmbH uses the following sub processors for processing personal data. Annex 2 to the DPA.

Mandatory sub processors

1) Google Cloud EMEA

Google Cloud EMEA Ltd, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland

Tasks: The LoyJoy infrastructure is operated in the Google Cloud by Google Ireland, and the server locations are within the EU. If personal data is processed, it is encrypted as far as possible.

2) BunnyWay d.o.o. (Bunny.net)

BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia (EU)

Tasks: Content Delivery Network (CDN) for fast delivery of the LoyJoy web application.

3) G-Core Labs S.A.

G-Core Labs S.A., 2 Rue Edmond Reuter, 5326 Contern, Luxembourg

Tasks: Content Delivery Network (CDN) for DDoS mitigation as a backup solution for Bunny.net to maximize availability and security.

4) Scaleway

Scaleway SAS, 8 rue de la Ville l’Evêque, 75008 Paris, France

Tasks: The LoyJoy infrastructure is operated in Scaleway, and the server locations are within the EU. If personal data is processed, it is encrypted as far as possible. Provision of AI-based language models for answering customer questions.

Remark: Google Cloud remains for now to ensure stability and avoid an abrupt switch (“Big Bang”). We will migrate operations gradually to Scaleway throughout the year 2026.

5) Nebius Group N.V.

Nebius Group N.V., Schiphol Boulevard 165, 1118 BG Schiphol, Netherlands

Tasks: Nebius handles internal AI tasks to improve platform functions and – in the Enterprise plan – creates summaries of dialogues. The server location is EU. Provision of AI-based language models for answering customer questions.

6) Amazon Web Services EMEA

Amazon Web Services EMEA SARL, 28 Avenue John F. Kennedy, L-1855, Luxembourg

Tasks: Email sending from LoyJoy is done via AWS. The server location is EU. For sending emails to end customers, a different SMTP can be configured in LoyJoy, effectively preventing the usage of AWS.

Optional sub processors

Upon request and instruction of the customer, the following sub processors may be used.

7) Microsoft Azure OpenAI (EU)

Microsoft Ireland Operations, Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland

Tasks: Provide an AI-based Language Model to answer customer questions. The server location is EU.

Description of security measures concerning transfers to third countries (Art.44): Transport encryption with TLS, certification according to the EU-U.S. Data Privacy Framework.

We will provide you with the standard contractual clauses upon request.

8) OpenAI (USA)

OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA

Tasks: Provide an AI-based Language Model to answer customer questions. The server location is the US.

Description of security measures concerning transfers to third countries (Art.44): Transport encryption with TLS, EU standard contractual clauses.

We will provide you with the standard contractual clauses upon request.

9) Mistral

Mistral AI, 15 Rue des Halles, 75001 Paris, France

Tasks: Provision of an AI-based language model for answering customer questions. The server is located in the EU.