List of active sub-processors
| Sub-processor | Purpose | Jurisdiction | Data residency | Document |
|---|---|---|---|---|
| Supabase, Inc. Managed database and storage. EU sub-processor | Database storage (Postgres), authentication, uploaded files (invoices, documents), and execution of backend functions. | US (company) · EU operations | Dublin, Ireland (eu-west-1) | DPA ↗ |
| Vercel Inc. CDN and application hosting. EU sub-processor | Serving HTML pages, scripts and static assets of the app.advanta.pt, admin.advanta.pt and advanta.capital platform. Does not store persistent personal data. | US (company) · multi-region CDN | Global CDN · EU prioritised | DPA ↗ |
| Anthropic, PBC Generative AI for data extraction. US sub-processor | Structured data extraction and verification via the Claude model. Data sent: invoice and contract content, and identity documents submitted for KYC verification. | US | US · transfer under SCC + DPF | DPA ↗ |
| Resend, Inc. Transactional email delivery. US sub-processor | Sending transactional emails (welcome messages, offer notifications, receipts). Data sent: email address, name, email content. | US | US · transfer under SCC + DPF | DPA ↗ |
| Attio Limited Contact management (CRM). UK sub-processor | Access requests and messages from the website forms. Data sent: name, email, company, message. | UK | UK · EU adequacy decision | Privacy ↗ |
| OpenSanctions Datenbanken GmbH Sanctions and PEP screening. EU sub-processor | Screening of suppliers and their representatives at onboarding and monthly thereafter. Data sent: company and representative names, tax identifiers. | Germany | EU (Germany) | Terms ↗ |
| Sentry (Functional Software, Inc.) Error tracking. US sub-processor | Technical error reports from the web applications; may contain user identifiers. | US | US · transfer under SCC | DPA ↗ |
| Google LLC Sign-in with Google (optional) and web fonts. US sub-processor | Authentication for accounts that choose Google sign-in; font files for the site. Data sent: account email for sign-in. | US | US · transfer under SCC + DPF | Privacy ↗ |
| Expo (650 Industries, Inc.) Push notifications for the mobile app. US sub-processor | Delivery of push notifications to the mobile companion app. Data sent: device push token, notification text. | US | US · transfer under SCC | Privacy ↗ |
SCC = European Commission Standard Contractual Clauses · DPF = EU-US Data Privacy Framework · DPA = Data Processing Agreement.
Change notifications
Before adding a new sub-processor or replacing an existing one, Advanta notifies customers with 30 days' prior notice, except in cases of operational emergency. The notification includes the name of the sub-processor, the purpose, the jurisdiction, and the applicable DPA document. Customers may object to the inclusion of a new sub-processor within the notice period by sending an email to dpo@advanta.pt.
International data transfers
Whenever a sub-processor operates outside the European Economic Area, the transfer is carried out under:
- Standard Contractual Clauses (SCC) approved by the European Commission, and
- Adherence to the EU-US Data Privacy Framework (DPF) where applicable.
No personal data is transferred to jurisdictions without an adequacy decision from the European Commission or additional approved safeguards.
Data Protection Officer (DPO)
For any question relating to sub-processors, the exercise of data subject rights, or requests concerning the GDPR, please contact: