Subprocessors

The register covers only identified legal entities whose actual processing of Personal Data on behalf of MAŃSKI AI s.r.o., in performing its processor obligations to the Customer, is evidenced. Using a cloud, API, payment service, software or another technology does not by itself establish that role. Actual operations, purposes, instructions, data and the legal relationship determine the classification.

Independent controllers and services processing data solely for the Provider’s own controller purposes are not automatically part of this chain. Their relevant roles and recipients are addressed in the Privacy Policy. The author of a locally used library with no flow of Personal Data to that author is not a subprocessor merely because of its licence. The absence of human reading or the use of encryption does not by itself exclude processing, such as storage.

This edition contains no published entries of confirmed subprocessors. That register status is not confirmation that no external service processes Personal Data. A statement that a deployment has no subprocessors may be made only after its actual flows and roles have been established. Customers may request relevant information at contact@veritasask.com.

Each confirmed entry identifies the actual legal entity and identifier, function and purpose, affected Personal Data categories, EU processing countries, access scope, relevant onward processing, contractual safeguards and appointment or change date. The Provider maintains evidenced entries centrally. Unresolved roles are tracked internally for review and are not published as confirmed subprocessors. Uncertainty does not itself authorise processing or postpone mandatory information or contractual duties.

Customer Data storage and processing must remain in the EU. The register may identify countries without publishing detailed infrastructure sites. “EU only” is not a substitute for a legally required country disclosure to the contracting institution. There is no generic pre-authorised exception for a non-EU processing location.

Only entities authorised under the agreed DPA may process the relevant data. Proposed additions or replacements receive at least 30 days’ written advance notice under DPA section 4, with sufficient information for a meaningful data-protection objection. We remain responsible for their performance of the relevant processor obligations. A website update alone does not prove that required notice was delivered.

Reasoned objections, alternatives and termination of the affected service follow the DPA. New processing must not begin while the necessary authorisation or location arrangement remains unresolved. Supply-chain information needed for statutory or contractual verification remains available through the agreed review process, subject to proportionate confidentiality.