Date: 25 October 2026 · Version: ab-2026-10-25
Processor: Sat-iTec AB, Simeå 8097, 82167 Vallsta, Sweden (Org.nr 559375-4335)
Platform: ChatiTec
Before content is transmitted to external AI providers, personal data and professional secrets are automatically anonymised (PII tokenisation). This anonymisation is enforced by default (PII_FORCE_FOR_EXTERNAL=true). Consequently, exclusively anonymised content without identifying plain-text personal data is transmitted to the external AI sub-processors listed in section 3. Re-mapping of the placeholders is only possible locally (Fernet-encrypted) on the platform infrastructure in Germany operated by Sat-iTec Systemhaus GmbH (section 2).
Transfer-free alternative: When purely local models (Ollama/vLLM) are used, no external AI sub-processors are engaged; content is then processed exclusively within the EU/EEA and no transfer to third countries takes place.
| No. | Sub-processor | Purpose of processing | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|---|
| 1 | Sat-iTec Systemhaus GmbH, Heisinger Straße 21, 87437 Kempten, Germany – group company of Sat-iTec AB | Operation of the ChatiTec platform; hosting in its own data centre in Germany (EU) (including housing and physical data centre operation); backups; support | All data processed on the platform (account data and content data, encrypted at rest at application level) | Germany (EU) | Within the EU/EEA – no transfer to third countries; agreement pursuant to Art. 28(4) GDPR |
| No. | Sub-processor | Purpose of processing | Data processed | Location / third country | Transfer mechanism (Chapter V GDPR) |
|---|---|---|---|---|---|
| 2 | OpenAI OpenAI Ireland Ltd. (for customers in the EEA) | AI/LLM inference (processing of anonymised inputs, generation of responses) | Exclusively anonymised content | USA | Standard contractual clauses (SCCs) pursuant to Art. 46 GDPR and/or EU-US Data Privacy Framework (Art. 45 GDPR), where certified |
| 3 | Anthropic Anthropic Ireland, Limited (for customers in the EEA) | AI/LLM inference (processing of anonymised inputs, generation of responses) | Exclusively anonymised content | USA | Standard contractual clauses (SCCs) pursuant to Art. 46 GDPR and/or EU-US Data Privacy Framework (Art. 45 GDPR), where certified |
| 4 | Google (Gemini) Google Ireland Ltd. | AI/LLM inference (processing of anonymised inputs, generation of responses) | Exclusively anonymised content | USA | Standard contractual clauses (SCCs) pursuant to Art. 46 GDPR and/or EU-US Data Privacy Framework (Art. 45 GDPR), where certified |
Note on the transfer mechanism: The decisive factor is the contractual basis of the specific provider in force at the relevant time. For US providers, the EU standard contractual clauses pursuant to Implementing Decision (EU) 2021/914 are primarily relevant; where the provider is certified under the EU-US Data Privacy Framework and an adequacy decision is applicable, this may also be relied upon. Whether this information is up to date is to be reviewed regularly.
| Provider | Status | Reason |
|---|---|---|
| DeepSeek | DEACTIVATED by default | Third-country/risk assessment China; cannot be used without an express, separate risk assessment and activation |
| No. | Provider | Purpose | Location | Transfer mechanism |
|---|---|---|---|---|
| 5 | Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland | Processing of payments for paid plans | Ireland (EU); transmission to Stripe, Inc. (USA) possible | Stripe acts as an independent controller for payment processing; no content data. Third-country transfer on the basis of the EU-US Data Privacy Framework or the EU standard contractual clauses |
| 6 | Internet Security Research Group (Let's Encrypt), San Francisco, USA | Issuance of TLS certificates (no content data) | USA | No processing of personal content data; technical domain validation only |
Changes to this list (engagement/replacement of sub-processors) will be notified to the Controller in good time in advance in writing (e-mail is sufficient) in accordance with § 5 of the Data Processing Agreement; the Controller has the right to object provided for therein. The technical and organisational measures are described in Annex 1.
Date: 25 October 2026 · Version: ab-2026-10-25