Frends Authorized Sub-processors

Frends Technology Oy ("Frends") uses certain sub-processors to assist it in providing the Frends Platform and related Professional Services as described in the Agreement concluded between Frends and the customer identified in the Agreement ("Customer").

In the event that Frends processes Customer's Personal Data in connection with the provision of the Frends Platform and related Professional Services, and in the event that a sub-processor engaged by Frends has or potentially will have access to such Personal Data, that sub-processor shall process the Personal Data of Customer as stipulated in the GDPR.

The purpose of this document is to list the authorized sub-processors of Frends who may take part in the provision of the Frends Platform and related Professional Services under the Agreement, and to outline the principles, procedures, and conditions pursuant to which these sub-processors may process the Personal Data of Customer. 

1. What is a Sub-processor?

A sub-processor is a third party that Frends engages to assist in providing the Frends Platform and related Professional Services, and that has or may have access to, or otherwise processes, Customer's Personal Data as part of that assistance. Sub-processors may include, for example, cloud infrastructure and hosting providers, as well as providers of software tools that Frends relies on to deliver the services. Third parties who do not have access to, and do not process, Customer's Personal Data are not sub-processors, regardless of any other role they may play in Frends' business.

2. Due Diligence

Frends undertakes to use a commercially reasonable selection process by which it evaluates the security, privacy, and confidentiality practices of proposed sub-processors that will or may have access to or process Customer's Personal Data. Frends has also executed a data processing agreement with each of its sub-processors, by which said sub-processors are committed to processing Personal Data in accordance with the GDPR and other applicable privacy laws and regulations.

3. List of Authorized Sub-processors

Frends Affiliates (including Frends Sweden AB, Frends Germany GmbH, Frends Poland sp. z o.o., as well as other Affiliates appointed by Frends from time to time) may act as sub-processors for Customer's Personal Data when their personnel participate in the processing of such Personal Data in connection with the provision of Frends services.

In addition, Frends uses certain unaffiliated third parties as sub-processors to perform specific processing functions related to its services. These unaffiliated sub-processors are described below.

3.1 Infrastructure Providers

The Frends Platform is primarily hosted by one of the infrastructure providers and in the locations listed below. Customers may select their preferred hosting provider from the available options. Additional hosting providers or locations may be made available upon mutual agreement between Frends and the Customer.

Additional Security Measures for Azure

Frends has implemented the EU Data Boundary regime in Azure, in line with the Schrems II judgment and related guidance. Frends uses reasonable efforts to prevent Microsoft from accessing Frends' encryption keys and certificates, including generating these outside of Microsoft where possible. However, such keys and certificates must be stored in Microsoft-provided services (e.g., Azure Key Vault) for encryption purposes, which may create a risk of access by Microsoft if required under, for example, the US CLOUD Act (Public Law 115-141).

Any transfers that may nonetheless be carried out by Microsoft irrespective of the Data Boundary regime are described at What is the EU Data Boundary? – Microsoft Privacy | Microsoft Learn.

Enhanced Control Deployment Options

Frends also offers fully on-premises and fully self-hosted deployment options for highly critical integration solution needs.

3.2 AI Providers (Microsoft Azure)

AI-related processing is carried out in two separate contexts, which are described separately below: (a) Frends AI, which is made available to Customer as part of the Frends Platform (Section 3.2.1 below); and (b) LLM models used by Frends itself in Professional Services (Section 3.2.2 below). The data residency commitments in Section 3.2.3 apply to both.

3.2.1 Frends AI (Platform)

"Frends AI" has the meaning given to it in the Platform Agreement. Where Customer uses Frends AI, the following Sub-processor applies.

3.2.2 LLM Models used by Frends in Professional Services

IIn Professional Services, Frends itself uses LLM models to perform tasks such as integration development for Customer. This use is separate from Customer's use of Frends AI. Where Personal Data is contained in the integration code or other materials processed by the LLM model, the following Sub-processor applies.

3.2.3 Microsoft regions, data zones and data residency

Frends deploys the LLM models used in Professional Services in the Azure region stated above and uses Microsoft's regional (single-region) deployment types for Personal Data. Frends does not use Microsoft's "Global" deployment types, under which prompts and responses may be processed in any geography where the relevant model is deployed, for Personal Data.

Under Microsoft's published terms, data stored at rest by the Azure service remains in the geography of the Azure resource (for the Sweden Central region, the Azure geography is Sweden), and Microsoft does not store or process customer data outside the customer-specified geography without authorization. Where Microsoft's "Data Zone" deployment types are used instead of regional deployments, prompts and responses are processed only within the Microsoft-defined data zone (for a resource in the EU, the EU Data Zone), and data stored at rest remains in the geography of the resource. Frends shall not move processing or storage of such Personal Data outside the region or data zone described in this Section 3.2 without notice under Section 6.3 of this DPA and, where required by Section 7, Customer's consent or configuration.

Under Microsoft's published terms, prompts, completions and other data processed by the Azure-hosted models are not made available to other Microsoft customers or to the model developer, and are not used to train or improve the underlying foundation models. Any service-level abuse monitoring data retained by Microsoft is stored within the Azure geography of the relevant resource.

For Customers who have opted for UAE hosting of Frends AI, Frends uses a regional deployment in the Microsoft Azure UAE North region, so that prompts and responses are processed in the United Arab Emirates and not routed to other regions.

3.3 Ticketing and Workflow Management Providers

Used by Frends on a case-by-case basis only where the Customer is expressly authorized under a separate agreement with Frends to include Customer Personal Data, other than ticket sender information, in a support ticket.

Frends will notify Customer of any material changes to this list of sub-processors, in accordance with the Frends Data Processing Agreement.