Sub-processors

Annex A to the data processing agreement. Published at querybeam.eu/subzpracovatele.

Version 1.0, effective from 2026-08-23

This is a translation. The Czech version prevails in the event of any discrepancy.

Article 1 – List of sub-processors

1.1The Operator has engaged the following further processors:

1.2Social sign-in providers (Google, Microsoft, Meta) process the data of application users, not the data of Called Persons, which never reaches them. In relation to sign-in they do not act as the Operator's sub-processors but as independent controllers.

Article 2 – Place of processing of call content

2.1The call transcript does not leave the European Union. Text processing, being the only processing in which the content of a call leaves as a whole, has been performed since 11 Aug 2026 by Mistral AI SAS on European servers. No transfer to a third country arises, and it therefore relies on no mechanism capable of losing its validity.

2.2Telephone connectivity is operated in Ireland.

2.3The application and the database are operated in Germany (Nuremberg). At the hosting layer, through which all processed data passes, no transfer to a third country arises.

2.4Call audio passes through the provider of the voice interaction outside the European Union. European residency is available from that provider only at Enterprise level, and even then its documentation states that processing may take place outside the European Union for support, content moderation and integrations. Until then this is a transfer to the USA under Article 3.

Article 3 – The transfer mechanism and its durability

3.1The EU–US Data Privacy Framework rests on the European Commission's adequacy decision of 10 July 2023. The General Court upheld that decision on 3 September 2025 (Case T-553/23 Latombe) and dismissed the action for annulment. The applicant brought an appeal; the case is before the Court of Justice under Case C-703/25 P and, as of August 2026, has not been decided.

3.2With ElevenLabs the Operator does not rely solely on the framework under Article 3.1; alongside it, the standard contractual clauses contained in the data processing agreement apply, and they operate independently of the fate of an adequacy decision.

3.3With Mistral AI SAS the question of a transfer mechanism does not arise. What does not leave the European Union needs no transfer mechanism and cannot therefore lose one.

Article 4 – Further links in the chain

4.1The provider of the voice interaction sources part of its services itself, and those may be a third party's. The chain therefore includes a sub-processor the Operator does not contract directly.

4.2The agreement with that provider contains an undertaking to inform the Operator of changes; the current list is checked periodically.

Article 5 – Changes to the list

5.1The Operator announces an intended change to controllers at least 30 days in advance under Article 5 of the data processing agreement.

5.2Record of changes made: