Subprocessor List

1. Core Subprocessor Register

Provider/Legal Entity	Service	Processing Purpose	Data Categories	Primary Locations	Transfer Safeguard	Status
Microsoft	Microsoft 365, Entra ID, support	Hosting, identity, communications, monitoring, support	Account, service, content, logs	[VERIFY]	[VERIFY]	Candidate
GitHub	Source control/automation	Code, issues, pipelines	Developer account, repository, logs	[VERIFY]	[VERIFY]	Candidate
Hetzner	Website/Portal infrastructure	Hosting, backup, networking	Content, account, logs	[VERIFY]	[VERIFY]	Candidate
[SUPPORT PLATFORM]	Ticketing/service management	Support delivery	Contacts, tickets, attachments	[VERIFY]	[VERIFY]	Candidate

2. Customer-selected Providers

Where elyXion connects directly to a provider contracted by the Customer, that provider may be the Customer’s processor rather than elyXion‘s subprocessor. The Order Form should clarify roles.

3. Notification

Customers subscribing to subprocessor notices may register at [NOTICE METHOD]. elyXion intends to provide [NOTICE PERIOD] notice before a new material subprocessor processes Customer Personal Data, except urgent replacement needed for security, continuity, or law.

4. Objections

Customers may object within [OBJECTION PERIOD] on reasonable data-protection grounds, describing the specific concern. elyXion will assess alternatives, safeguards, or service changes under the DPA.

5. Due Diligence

elyXion assesses providers proportionate to risk, including security, privacy terms, data location, breach duties, deletion, continuity, and subcontracting. Contractual review does not guarantee a provider will never experience an incident.

3. Change Log

Date	Change	Services Affected	Effective Date
[DATE]	Initial verified list	[SERVICES]	[DATE]