Change history (4 entries)

18/05/2026 Scaleway section reworded for clarity.
06/05/2026 easybell GmbH added as mandatory sub-processor for telephony functions of the LoyJoy Phone Agent.
05/05/2026 Microsoft Azure reclassified from optional to mandatory sub-processor and extended to cover speech-to-speech and telephony functions of the Phone Agent.
01/03/2026 Initial publication of the sub-processor list.

LoyJoy GmbH uses the following sub processors for processing personal data. Annex 2 to the DPA.

Mandatory sub processors

1) Google Cloud EMEA

Google Cloud EMEA Ltd, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland

Tasks: The LoyJoy infrastructure is operated in the Google Cloud by Google Ireland, and the server locations are within the EU. If personal data is processed, it is encrypted as far as possible.

2) BunnyWay d.o.o. (Bunny.net)

BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia (EU)

Tasks: Content Delivery Network (CDN) for fast delivery of the LoyJoy web application.

3) G-Core Labs S.A.

G-Core Labs S.A., 2 Rue Edmond Reuter, 5326 Contern, Luxembourg

Tasks: Content Delivery Network (CDN) for DDoS mitigation as a backup solution for Bunny.net to maximize availability and security.

4) Scaleway

Scaleway SAS, 8 rue de la Ville l’Evêque, 75008 Paris, France

Tasks: Operation of the LoyJoy infrastructure with server locations within the EU. If personal data is processed, it is encrypted as far as possible. Provision of AI-based language models for answering customer questions.

5) Nebius Group N.V.

Nebius Group N.V., Schiphol Boulevard 165, 1118 BG Schiphol, Netherlands

Tasks: Nebius handles internal AI tasks to improve platform functions and – in the Enterprise plan – creates summaries of dialogues. The server location is EU. Provision of AI-based language models for answering customer questions.

6) Amazon Web Services EMEA

Amazon Web Services EMEA SARL, 28 Avenue John F. Kennedy, L-1855, Luxembourg

Tasks: Email sending from LoyJoy is done via AWS. The server location is EU. For sending emails to end customers, a different SMTP can be configured in LoyJoy, effectively preventing the usage of AWS.

Mandatory sub processors for Phone Agent use

The following sub-processors are only active when the LoyJoy Phone Agent is used and are only engaged for data processing in that case.

7) Microsoft Azure

Microsoft Ireland Operations, Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland

Tasks: Provision of AI-based language models for answering customer questions, and provision of a speech-to-speech model for telephony dialogues. This includes, depending on configuration, processing of voice inputs, generation of voice outputs, processing of transcripts, provision of the audio stream, receiving and processing telephony calls, handling telephony control commands (e.g. call forwarding), and provisioning of phone numbers.

Server location: Text-based Azure OpenAI processing takes place in EU regions. Speech-to-speech functions of the Phone Agent are currently processed via global Azure services, as this feature is not yet available as an exclusive EU region.

Description of security measures for transfers to third countries (Art. 44 GDPR): Transport encryption with TLS, EU Standard Contractual Clauses, certification under the EU–U.S. Data Privacy Framework, and the technical and organisational measures provided by Microsoft.

We will provide you with the standard contractual clauses upon request.

8) easybell GmbH

easybell GmbH, Brückenstraße 5a, 10179 Berlin, Germany

Tasks: Provisioning and provision of phone numbers, receiving and processing telephony calls, provision of the audio stream, handling telephony control commands (e.g. call forwarding), and technical provision of telephony functions for the LoyJoy Phone Agent.

Server location: Germany and the European Union, to the extent provided by easybell for the respective service.

Description of security measures for transfers to third countries (Art. 44 GDPR): Where a transfer to third countries cannot be excluded, it is carried out on the basis of appropriate safeguards, in particular EU Standard Contractual Clauses, transport encryption and further technical and organisational measures.

Optional sub processors

Upon request and instruction of the customer, the following sub processors may be used.

9) OpenAI (USA)

OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA

Tasks: Provide an AI-based Language Model to answer customer questions. The server location is the US.

Description of security measures concerning transfers to third countries (Art.44): Transport encryption with TLS, EU standard contractual clauses.