List of Subprocessors
Effective Date: September 28, 2026
About this List
This List identifies third parties used by Be Informed B.V. (“Be Informed”, “we”, “our” or “us”) to help deliver, operate, maintain or support the standard Digital Services covered by the Be Informed Data Processing Addendum (“DPA”), where those third parties may process Customer Personal Data on our behalf.
Capitalized terms not defined in this list have the meanings given in the DPA or the applicable agreement. Under the DPA, a Subprocessor is a third party engaged by Be Informed to Process Customer Personal Data on behalf of a Customer.
This List is consolidated by supplier. The “Processing purpose and role” column describes how each supplier participates in the delivery, operation, maintenance or support of the relevant Digital Services. A supplier may support more than one service or processing activity. Inclusion does not mean that every supplier is used for every Customer or processes every category of Customer Personal Data.
Scope
This List applies to standard Digital Services for which Be Informed acts as Processor or Subprocessor under the public DPA.
This List does not automatically apply to bespoke applications, dedicated managed-service solutions, customer-specific hosting arrangements, customized implementations, or other separately contracted environments. Those arrangements may use different subprocessors or be governed by separate data-processing terms.
Suppliers used solely for activities in which Be Informed acts as Controller, including general website operation, marketing, finance, human resources, and internal administration, are not included solely for those roles. More information about Be Informed’s controller-side processing is provided in the Privacy Notice and Cookie Policy.
Current Subprocessors
The following subprocessors are approved for the applicable processing activities described below.
| Subprocessor | Processing purpose and role | Information processed | Principal processing location | Contractual / transfer safeguards |
| Harbers ICT (Harbers ICT B.V.) | Production hosting and operation of customer-facing Digital Services, including infrastructure, storage, backups, identity services, networking, recovery, and infrastructure-level support. | Customer Content and Customer Personal Data stored in the service; account and authentication data; operational and diagnostic information. | Netherlands | Processing within the EEA; DPA. |
| Equinix (Equinix Inc.) | Provision of datacenter facilities used by Harbers ICT to host and operate customer-facing Digital Services. | Systems and storage containing Customer Content and Customer Personal Data are physically hosted in the facilities; the provider role is limited to datacenter facilities. | Netherlands | Processing within the EEA; contractual safeguards through the hosting chain. |
| Atlassian (Atlassian Pty Ltd.) | Support ticketing, support workflow management, operational documentation, and collaboration used to provide, maintain, and support customer-facing Digital Services. | Customer contact information; support communications; limited diagnostics, screenshots, attachments, and investigation information where provided or required. | European Union | DPA; international transfer safeguards where applicable. |
| Microsoft (Microsoft Ireland Operations, Ltd.) | Customer communications, operational collaboration, escalation, secure file exchange, and issue resolution used in providing and supporting customer-facing Digital Services. | Customer contact information; support communications; files, diagnostics, or other limited Customer Personal Data used during authorized support activities. | European Union | Microsoft DPA; international transfer safeguards where applicable. |
| HubSpot (HubSpot, Inc.) | Service onboarding, service-related communications, and email notifications forming part of Digital Service delivery. | Customer and Authorized User contact information; account, onboarding, communication, and notification information. | European Union | DPA; international transfer safeguards where applicable. |
| Avetica (Avetica B.V.) | Hosting and operation of the online learning platform used to provide training and enablement services to customer users. | Participant identity and contact information; account information; registrations; participation; learning progress; completion and related training records. | European Union | Processing within the EEA; DPA. |
| OpenRouter (OpenRouter, Inc.) | Provision of AI infrastructure and related services supporting customer-facing AI functionality | Selected Customer Content supplied to the AI feature, configuration and routing metadata, and generated output. | European Union | DPA; international transfer safeguards where applicable. |
| OpenAI (OpenAI Ireland Ltd.) | Provision of AI model functionality used through customer-facing AI features. | Selected Customer Content supplied to the AI feature, and generated output. | European Union | DPA; international transfer safeguards where applicable. |
Changes to Subprocessors
When you accept the Agreement, you authorize Be Informed to use subprocessors to help deliver, operate, maintain and support the Services.
Be Informed may add, replace or remove subprocessors from time to time as our services, suppliers or infrastructure evolve. When we intend to add or replace a subprocessor that may process Customer Personal Data, we will provide at least thirty (30) days’ advance notice through the published subscription mechanism, the registered email address, or another reasonable electronic channel.
If you have a reasonable data protection or information security concern about a proposed subprocessor, you may object in writing within ten (10) days after receiving the notice. Your objection should explain the specific concern and the reasons for it.
If an objection is received, Be Informed will discuss with you the concern in good faith and consider reasonable alternatives or additional safeguards. The objection process and available remedies are governed by the Data Processing Addendum.
Processing Locations and International Transfers
The location stated in this List is the principal processing location or region used for the applicable processing activity. A supplier may use affiliated companies, personnel, infrastructure, or its own subprocessors in other locations, subject to the DPA, applicable data protection law, contractual restrictions, and the selected service configuration.
Where Customer Personal Data is transferred from the European Economic Area to a country that is not recognized as providing an adequate level of protection, Be Informed will use an applicable lawful transfer mechanism, including the European Commission Standard Contractual Clauses together with supplementary measures where required. An applicable adequacy decision may be relied upon where its requirements are met.
Customer-Specific Arrangements
Some customers may have service-specific agreements that identify additional or alternative subprocessors, processing locations, or data-residency commitments. Where this applies, those customer-specific agreements take precedence for the affected services.
Contact
Questions, objections, or requests for further information concerning this List or the subprocessors identified in it may be sent to:
Be Informed B.V.
Apeldoorn, the Netherlands
privacy@beinformed.com