Scope
1.1This list forms Annex III to the Data Processing Agreement and identifies the sub-processors Prduct ApS engages to deliver the Platform under the Terms of Use and the Subscription Agreement.
1.2A sub-processor is a third party engaged by Prduct to process personal data on behalf of a customer as controller. Every sub-processor is bound by a written agreement imposing substantially the same obligations as the Data Processing Agreement, implements appropriate security measures and processes personal data only as instructed.
1.3Prduct remains fully liable to the customer for the performance of its sub-processors.
1.4Where a customer authenticates its users through its own identity provider, for example Microsoft Entra ID using OpenID Connect, that provider acts on the customer’s instructions and is not a sub-processor of Prduct. Prduct receives only the identity assertion issued by the customer’s provider and processes it as described in the Data Processing Agreement.
Current Sub-Processors
2.1The following sub-processors are authorised as at 10 September 2026.
| Sub-processor | Registered address | Purpose | Processing location | Scope of processing |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL VAT ID: LU 26888617 |
38 Avenue John F. Kennedy, L-1855, Luxembourg | Cloud infrastructure, hosting and artificial intelligence services | EU (Stockholm, Frankfurt) | Amazon Web Services provides cloud infrastructure and computing services, including storage, networking, databases, analytics and security tooling. AWS acts as a processor and processes customer data, including personal data, on the instructions of the customer as controller. Processing includes hosting, storage, transfer, backup and the operations necessary to run cloud-based applications. AWS does not access or use customer content except as necessary to maintain the services or as required by law. Processing is governed by the AWS Data Processing Addendum, which incorporates the EU Standard Contractual Clauses for international transfers. |
| Microsoft Ireland Operations Limited | One Microsoft Place, South County Business Park, Leopardstown, Dublin 12, D18 P521, Ireland | Cloud infrastructure, hosting and artificial intelligence services | EU | Microsoft Azure provides cloud computing services and processes personal data depending on the services used, including storage, computation and networking services that may handle customer data. Processing is governed by the Microsoft Products and Services Data Protection Addendum, which sets out the data protection and security commitments for Azure services. |
| Microsoft Ireland Operations Limited | One Microsoft Place, South County Business Park, Leopardstown, Dublin 12, D18 P521, Ireland | Business communication (Microsoft 365) | EU | Microsoft 365 processes personal data including email content, calendar entries, contact information and usage data. Processing is governed by the Microsoft Products and Services Data Protection Addendum, which sets out the obligations regarding data processing and security measures. |
| Intercom R&D Unlimited Company | 124 St Stephen’s Green, Dublin 2, D02 C628, Ireland | Support and sales messaging | EU and United States (EU Standard Contractual Clauses) | Intercom provides customer messaging and support services and processes personal data such as user identifiers, communication metadata and behavioural analytics on behalf of its customers. Processing is conducted in accordance with the Intercom Data Processing Agreement, which sets out the scope and nature of the data handling activities. |
Notification of Changes
3.1Prduct notifies customers at least 30 days before a new sub-processor begins processing personal data, by email to the account email address and by updating this page.
3.2A customer may object to a new sub-processor on reasonable grounds relating to data protection within 30 days of notification. The parties will discuss alternatives in good faith; if none is found, the customer may terminate the affected services with 30 days’ notice and receive a pro-rata refund where applicable. Section 6.5 of the Data Processing Agreement governs the procedure.
International Transfers
4.1Personal data is primarily processed and stored in the EU. Where a sub-processor processes personal data outside the EU or EEA, the EU Standard Contractual Clauses (Decision 2021/914, Module 2) apply, supplemented by technical measures and a transfer impact assessment, as set out in Section 7 of the Data Processing Agreement.
Contact
Data Protection Officer: dpo@prduct.comSecurity incidents: security@prduct.com
General: legal@prduct.com