List of active sub-processors
| Sub-processor | Purpose | Jurisdiction | Data residency | Document |
|---|---|---|---|---|
| Supabase, Inc. Managed database and storage. EU sub-processor | Database storage (Postgres), authentication, uploaded files (invoices, documents), and execution of backend functions. | US (company) · EU operations | Frankfurt, Germany (eu-central-1) | DPA ↗ |
| Vercel Inc. CDN and application hosting. EU sub-processor | Serving HTML pages, scripts and static assets of the corp.advanta.pt and advanta.capital platform. Does not store persistent personal data. | US (company) · multi-region CDN | Global CDN · EU prioritised | DPA ↗ |
| Anthropic, PBC Generative AI for data extraction. US sub-processor | Structured data extraction from invoice PDFs/images via the Claude model. Data sent: invoice content. Anthropic does not train models on API data by default. | US | US · transfer under SCC + DPF | DPA ↗ |
| Resend, Inc. Transactional email delivery. US sub-processor | Sending transactional emails (welcome messages, offer notifications, receipts). Data sent: email address, name, email content. | US | US · transfer under SCC + DPF | DPA ↗ |
| Thinkland S.A. (ThinkPay) Payment initiation. EU sub-processor | Initiation and execution of SEPA Instant and SCT payments on behalf of the corporate client, under its PSD2 authorisation. | Portugal | Portugal · Banco de Portugal supervision | Request |
| Sentry GmbH Error monitoring. EU sub-processor | Capture and aggregation of exceptions and runtime errors for diagnostics. Data sent: stack trace, anonymised session identifier. No invoice data. | Germany | EU | DPA ↗ |
| Plausible Insights OÜ Web traffic analytics. EU sub-processor | Aggregated and anonymous analysis of pages visited on advanta.capital and corp.advanta.pt. No cookies. No user identification. GDPR-compliant with no need for a consent banner. | Estonia | Germany | DPA ↗ |
SCC = European Commission Standard Contractual Clauses · DPF = EU-US Data Privacy Framework · DPA = Data Processing Agreement.
Change notifications
Before adding a new sub-processor or replacing an existing one, Advanta notifies customers with 30 days' prior notice, except in cases of operational emergency. The notification includes the name of the sub-processor, the purpose, the jurisdiction, and the applicable DPA document. Customers may object to the inclusion of a new sub-processor within the notice period by sending an email to dpo@advanta.pt.
International data transfers
Whenever a sub-processor operates outside the European Economic Area, the transfer is carried out under:
- Standard Contractual Clauses (SCC) approved by the European Commission, and
- Adherence to the EU-US Data Privacy Framework (DPF) where applicable.
No personal data is transferred to jurisdictions without an adequacy decision from the European Commission or additional approved safeguards.
Data Protection Officer (DPO)
For any question relating to sub-processors, the exercise of data subject rights, or requests concerning the GDPR, please contact: