Subprocessor List

Version 2026-09-25 · Convenience translation · Permanent address of this version: https://opsway.com/legal/subprocessors/2026-09-25/en

This is a convenience translation. The Polish text governs. The authoritative text of this version is the Polish text published at https://opsway.com/legal/subprocessors/2026-09-25. In the event of any discrepancy between this translation and the Polish text, the Polish text prevails.

This list identifies all third parties processing personal data on the Client's behalf in the provision of services by Digital Delivery Center sp. z o.o. (OpsWay) under an Order Form. In accordance with § 5(2) of the DPA it constitutes an exhaustive enumeration: a supplier not listed here is not engaged.

The "Status" column. Confirmed — the supplier's involvement in services work is established. To be confirmed — the supplier may process Client data in certain configurations of the work; the entry appears on the list so that the enumeration remains complete, and its status will be settled in a future version. Until then OpsWay treats such an entry as a subprocessor covered by the general authorisation under § 5(1) of the DPA.

The principal place of processing remains the Client's environment (§ 6(1) of the DPA), which is subject to the Client's own contracts, not OpsWay's. The list below concerns OpsWay's systems.

A. Subprocessors

#	Subprocessor	Purpose	Categories of data	Region	Status
1	Anthropic, PBC	AI inference — AI Systems used in performing the work, operating on OpsWay's account (§ 13(3) of the OWŚU)	Content of instructions and reports, context from the Client's Odoo environment, fragments of code and configuration, output produced by the agent	Global inference; data retained in the United States — third country	Confirmed
2	GitHub, Inc. (Microsoft Corporation)	Hosting of private repositories of the Client's project code, change review, CI pipelines	Source code and configuration of the Client's project, repository and issue metadata; personal data to the extent it is placed in the repository — e.g. migration datasets, test data, screenshots	United States (supplier's seat) — third country; residency settings for the organisation's repositories not confirmed	Confirmed
3	Google Ireland Limited (Google Workspace)	Mail, documents and shared drive used in project communication and file exchange with the Client	Project correspondence, documents, exports and statements provided by the Client, attachments	Ireland (supplier's seat, EEA); Data Regions settings not confirmed	Confirmed
4	Atlassian (Jira Cloud)	Recording and running tickets, tasks and the history of project work	Ticket content, attachments and screenshots, contact details of the Client's personnel taking part in the project	Netherlands or Australia, depending on the contracting entity; the instance's data residency realm not confirmed	Confirmed
5	Slack Technologies (Salesforce, Inc.)	Working communication channels with the Client, transfer of files and screenshots	Message content in channels with the Client, files and screenshots provided by the Client	United States or Ireland, depending on the contracting entity; residency settings not confirmed	Confirmed
6	Odoo S.A. (Odoo.sh)	Hosting of the project environment and backups downloaded for diagnostics and development work	The full content of the Client's Odoo environment, including the personal data present in it	Belgium (supplier's seat, EEA); hosting region depends on the environment's configuration	To be confirmed — where the Client contracts with Odoo S.A. (the standard model, § 5(1)(a) of the OWŚU), this is the Client's own system and not an OpsWay subprocessor; where in a given project OpsWay contracts on the Client's account, it is a subprocessor
7	Tempo Software (application within Jira Cloud)	Time recording linked to project tickets	Time records of OpsWay personnel linked to the Client's tickets; Client personal data only to the extent it appears in the linked tickets	As per the region of the Jira Cloud instance — see entry 4	To be confirmed — whether the scope of processing covers Client personal data or only OpsWay personnel data
8	Grain Intelligence, Inc.	Recording and transcription of project meetings	Recording and transcript of participants' statements, names, content of the conversation	United States (supplier's seat) — third country	To be confirmed — whether meetings within engagements covered by an Order Form are recorded
9	Other AI System suppliers — OpenAI, Google	AI inference, if used alongside entry 1	As entry 1	United States / Ireland, depending on the supplier and the contracting entity	To be confirmed — Annex 3 of the previous framework agreement listed these suppliers; it has not been confirmed whether they are used in services work

B. Systems that are not subprocessors

Listed for the avoidance of doubt:

Entity / system	Why it is not an OpsWay subprocessor
The Client's own systems — its Odoo, GitHub, Jira, Slack, production, banking and public systems	The Client's systems, which OpsWay accesses using the Client's credentials and under its control.
Odoo S.A. in the standard model	The Client procures and pays for Odoo System licences and subscriptions and the Client Environment at its own cost (§ 5(1)(a) of the OWŚU). See, however, entry 6 in section A.
Odoo Resolution Center (ORC)	A separate service, covered by a separate set of documents and its own Subprocessor List at `help.opsway.com/legal`. A Client using only services under an Order Form does not entrust data to the ORC infrastructure.
OpsWay's own record systems — OpsWay's Odoo, billing documentation	In respect of these OpsWay is a separate controller (§ 1(2) of the DPA), not a processor acting on the Client's behalf.

C. Transfers to third countries

Entries 1, 2, 8 and 9 in section A involve transfers of personal data outside the European Economic Area. Entries 4 and 5 may do so depending on the contracting entity.
These transfers take place using a mechanism under Chapter V GDPR, including the standard contractual clauses (Commission Implementing Decision (EU) 2021/914) where applicable, in accordance with § 7 of the DPA.
Limitation of assurance. OpsWay has not concluded a separate, complete set of standard contractual clauses with each supplier listed in section A and gives no assurance that such a set exists. To the extent not covered by its own set, OpsWay relies on the published data protection terms of the supplier concerned. The Client, as controller, makes its own assessment of the permissibility of the transfer.
Data residency settings at the suppliers in entries 2 to 5 have not been confirmed and are not the subject of any assurance. The region stated is the supplier's seat, not a confirmed storage location.

D. Changes to the list — notice and objection

OpsWay notifies the Client of any intention to add or replace a direct subprocessor with at least thirty (30) days' prior notice, identifying the version of this list and its permanent URL.
Within that period the Client may object on reasonable data protection grounds, giving reasons. The Parties shall attempt to resolve the objection.
Where an objection is raised that cannot reasonably be resolved, the Client may terminate the affected Order Form with effect as at the date the change takes effect; OpsWay is entitled to remuneration for services performed up to that date.
OpsWay passes on notice of a change of subprocessor made by a subprocessor without undue delay after receiving it; the objection period is set by the originating notice.
Settling the status of an entry from "To be confirmed" to "Confirmed" does not constitute the addition of a subprocessor and does not start the period under paragraph 1, because the entry has appeared on the list since its publication. A change in the other direction — removal of an entry — likewise requires no notice.
A change to this list requires thirty days' prior notice irrespective of any other period; the clock runs on a calendar, not on a deployment.

Version 2026-09-25 · Digital Delivery Center sp. z o.o. · KRS 0000964819 · Convenience translation — the Polish text at https://opsway.com/legal/subprocessors/2026-09-25 governs