Subprocessor and Data-Location List
BioCV LISA • Engaged under Article 28(4) GDPR
Contents
This is one centrally maintained page referenced in Sections 14.5 and B.12 and the DPA (Annex B) of the BioCV LISA Terms. This list is available at https://biocv.info/legal/subprocessors; it is not a customer-specific or invoice-specific annex. Changes are notified as contemplated by the DPA (email and/or in-account notice) before a new subprocessor begins processing.
1. Current Subprocessors
BioCV GmbH engages the following subprocessors to process personal data on behalf of Customers in connection with the LISA products and services. Where a subprocessor processes data outside the EEA, the applicable transfer mechanism is identified.
| Subprocessor | Service / role | Processing activity & data | Location / region | Transfer mechanism |
|---|---|---|---|---|
| Google Cloud EMEA Limited (Gordon House, Barrow Street, Dublin 4, Ireland), as identified on BioCV's Google Cloud invoicing | Cloud infrastructure, hosting, database, storage, authentication, logging | Hosting and storage of account, device, animal, configuration, telemetry and log data (Firestore eur3; Frankfurt and Belgium; EU Cloud Storage/BigQuery/backups). Google Cloud logging uses globally located log buckets; diagnostic logs may include technical device identifiers (e.g. MAC addresses). Other Google Cloud processing locations are governed by the Google Cloud Data Processing Addendum and its location and transfer commitments. | EU (eur3 / Frankfurt / Belgium); logging: global log buckets; other locations per Google DPA | EEA processing – none required for EU regions; for processing outside the EEA, EU Standard Contractual Clauses under the Google Cloud Data Processing Addendum (Chapter V GDPR) |
| Google Workspace (Google Cloud EMEA Limited, Dublin, Ireland) | Business, support and privacy e-mail (privacy@, support@, legal@, returns@, info@ biocv.org) | Account, support and privacy correspondence | EU-primary; global processing per the Google Workspace Data Processing Addendum | EU Standard Contractual Clauses under the Google Workspace DPA for processing outside the EEA (Chapter V GDPR) |
For any subprocessor outside the EEA and not covered by an adequacy decision, the transfer is made under the applicable module(s) of the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) with completed annexes and a transfer impact assessment, or another valid Chapter V GDPR mechanism. Until such a mechanism is in place, no transfer to that subprocessor occurs.
1a. BioCV Inc. Subprocessors (North America)
Where BioCV Inc. engages subprocessors that differ from those above for North American customers, they are identified in the section below or, alternatively, in a separate US subprocessor list. In either case the information is published at a permanent URL and does not accompany invoices or Orders.
BioCV Inc. uses the same subprocessors listed above. In particular, hosting and platform operations for BioCV Inc.'s U.S. customers are provided by BioCV GmbH on the EU-based infrastructure identified above; BioCV Inc. does not maintain a separate EU customer database and does not have access to EU customer databases. This intercompany arrangement is governed by a processing/service-provider agreement between BioCV Inc. and BioCV GmbH.
No AI provider, third-party analytics/monitoring provider, external ticketing provider, or payment processor is currently engaged as a subprocessor for customer data. Stripe is not yet active and is not a current provider. This list and the Privacy Notices will be updated before Stripe or any other new provider begins processing customer data.
2. Processing Locations Summary
Customer Data is processed and stored primarily in the EU (Firestore eur3; Frankfurt and Belgium; EU Cloud Storage, EU BigQuery and EU backups). Known processing outside the EEA includes Google Cloud logging in globally located log buckets (diagnostic logs that may include technical device identifiers such as MAC addresses). Other Google Cloud processing locations are governed by the Google Cloud Data Processing Addendum and its location and transfer commitments; any such processing is covered by the transfer mechanism in the table above. This is consistent with the Data Act Transparency Statement.
3. Changes and Right to Object
BioCV maintains this list current. Before adding or replacing a subprocessor, BioCV will update this list and, as provided in the DPA, give Customers the opportunity to object to a new subprocessor on reasonable data-protection grounds.
BioCV notifies changes by e-mail to account administrators and/or an in-account notice at least 30 days before a new subprocessor begins processing customer data, giving Customers the opportunity to object on reasonable data-protection grounds.
Subprocessor and Data-Location List — Version 1.4, effective 10 August 2026. Contracting entity: BioCV GmbH.