Sub-processors
Maintained under Article 28(2) and (4) GDPR
Current sub-processors
By signing the Data Processing Agreement, the Client grants general written authorisation to the sub-processors below. Salviminda notifies clients of any intended addition or replacement at least 30 days in advance, and a client may object on reasonable data-protection grounds within that period. Where an objection cannot be resolved by agreeing an alternative, either party may terminate the affected part of the service.
| Sub-processor | Purpose | Location | Transfer safeguard | Status |
|---|---|---|---|---|
| Microsoft Ireland Operations Ltd | Cloud infrastructure for S-Link Hub: compute, database hosting, encrypted storage, logging and backup; Microsoft 365 for internal e-mail and document storage | European Union — Azure West Europe (Netherlands) | Within the EU. Microsoft Products and Services Data Protection Addendum (Art. 28); EU Data Boundary commitments | Active |
| B2Brouter Global SL, NIF B63276174, Barcelona | Peppol access point and French accredited platform: primary channel for transmission, conversion and archiving of business documents | European Union — Spain | Within the EU. Art. 28 DPA; ISO/IEC 27001 certified | Active |
| Freelance professionals engaged directly by Salviminda | Development and support work for the Services, involving remote access to client environments and to data held in S-Link Hub | Philippines (remote access to EU-hosted systems) | Standard Contractual Clauses (Implementing Decision (EU) 2021/914) with each individual; documented transfer impact assessment reviewed annually; named accounts, MFA, least-privilege and time-limited access; no local storage of client data | Active |
| Avalara Europe Ltd | Peppol access point: secondary channel, engaged only where the Client contracts for it | United Kingdom | European Commission adequacy decisions for the United Kingdom, renewed 19 December 2025 and valid until 27 December 2031; Art. 28 DPA | Planned — not yet active |
Notes
Scope of this list. It covers processors engaged by Salviminda that process client personal data on Salviminda’s behalf. It does not list recipients acting as controllers in their own right, or platforms to which transmission is required by law — see the note on Chorus Pro below. Professional advisers bound by professional confidentiality are not sub-processors of the service.
Freelance professionals in the Philippines. These individuals are contracted directly by Salviminda, without any labour broker, agency or intermediary, and work under Salviminda’s authority and documented instructions — which means they may equally be characterised as persons acting under the processor’s authority within the meaning of Article 29 GDPR rather than as sub-processors. Salviminda lists them here in either case, so that clients have full visibility of who can access their data and from where. Data at rest is not replicated outside the European Union; access from the Philippines is remote access to EU-hosted systems.
Chorus Pro (French public sector). Where a client issues an invoice to a French public-sector body, transmission through Chorus Pro, operated by the Agence pour l’informatique financière de l’État, is required by French law. Chorus Pro is the French State’s platform for business-to-government invoicing; it is a recipient acting under a legal obligation and under public-sector data protection rules, not a sub-processor selected by Salviminda, and is therefore not listed above.
French business-to-business reform. France abandoned the plan for the public portal to exchange company invoices in October 2024; exchange now runs through accredited private platforms, and the DGFiP has acted as the Peppol Authority for France since July 2025. From 1 September 2026 all businesses established in France must be able to receive electronic invoices, with the obligation to issue them phased in thereafter. S-Link relies on B2Brouter’s accreditation for this route.
Changes to this list. Clients are notified of intended changes at privacy@salviminda.com and may raise an objection to the same address.