AKI.IO Sub-processors and Service Providers

This is the single canonical list of sub-processors, further sub-processors and service providers used by AKI.IO in connection with its services and processing activities. For Customers remaining subject to an earlier version of the Data Processing Agreement (DPA), the sub-processors authorized under that DPA continue to apply. Listing a provider in Section 1 does not by itself authorize that provider for processing under an earlier DPA.

Section 1 is part of the DPA and lists sub-processors and further sub-processors involved in the provision of the AKI.IO services defined in the DPA. The authorization requirements for the engagement of sub-processors and further sub-processors set out in Section 5 of the DPA apply.

Section 2 is not part of the DPA. It lists service providers and contractors who perform other services for AKI.IO (payment service providers, tax rate determination, email, online marketing, etc.) for processing activities for which AKI.IO GmbH acts as controller within the meaning of Art. 4(7) GDPR. These are listed for the sake of transparency. This part of the list (Section 2) is referenced in the Privacy Policy.

Section 1: Sub-processors for processing carried out on Customers’ behalf

1. AIME

AIME GmbH Marienburger Straße 1, 10405 Berlin, Germany

Role

Sub-Processor in AKI.IO’s processing chain.

Purpose

Provision and hosting of dedicated high-performance computing infrastructure and GPU cloud instances used by AKI.IO to operate its own inference workers and AI models.

Processing location

Germany

Type of processing

Infrastructure hosting and compute processing pursuant to Art. 28 GDPR: Provision and operation of GPU compute infrastructure on which AKI.IO operates its inference AI models. Personal data contained in inference requests and responses may be processed transiently on this infrastructure as part of the computation performed by AKI.IO.

Categories of data

Input data (prompts/text), output data (AI responses), technical metadata (timestamps, model parameters, IP addresses)

Categories of data subjects

Employees, representatives, customers, suppliers and end users of AKI.IO Customers, as well as other individuals whose personal data is contained in Customer Content submitted for processing.

Trust Level

TL5

• German data residency
• Germany operator

Retention and deletion

Zero Data Retention / transient processing only. Customer Personal Data is not used for model training, product improvement or other provider purposes. Customer Personal Data is deleted or returned at the end of the processing in accordance with the DPA. Backup copies, if any, are deleted or overwritten after 90 days. Any legally required retention is limited to the statutory purpose and period.

International transfers and safeguards

No transfer outside the EU/EEA.

203 StGB suitability

Applicable subject to separate confidentiality agreement and confirmation of all required technical, contractual and organisational safeguards.

2. ScaleUp Technologies

ScaleUp Technologies GmbH & Co. KG Süderstr. 198, 20537 Hamburg, Germany

Role

Further sub-processor on behalf of AIME GmbH. The entity providing the physical data center and colocation infrastructure used for the AIME GPU infrastructure.

Purpose

Provision and operation of colocation and data center infrastructure in Germany, including rack space, power supply, network connectivity, physical security and related infrastructure services.

Processing location

Germany

Type of processing

Infrastructure hosting pursuant to Art. 28 GDPR: Provision and operation of the physical data center, colocation, power and network infrastructure used to host the GPU systems operated by AIME GmbH. ScaleUp Technologies does not operate AKI.IO’s AI models or inference applications.

Categories of data

Personal data processed by AKI.IO may be present on systems hosted within ScaleUp’s data center infrastructure, including input data (prompts/text), output data (AI responses) and associated technical metadata. ScaleUp does not require access to this data for the provision of its standard colocation services.

Categories of data subjects

Employees, representatives, customers, suppliers and end users of AKI.IO Customers, as well as other individuals whose personal data is contained in Customer Content submitted for processing.

Trust Level

TL5

• German data residency
• Germany operator

Retention and deletion

Zero Data Retention / transient processing only. Customer Personal Data is not used for model training, product improvement or other provider purposes. Customer Personal Data is deleted or returned at the end of the processing in accordance with the DPA. Backup copies, if any, are deleted or overwritten after 90 days. Any legally required retention is limited to the statutory purpose and period.

International transfers and safeguards

No transfer outside the EU/EEA.

203 StGB suitability

Applicable subject to separate confidentiality agreement and confirmation of all required technical, contractual and organisational safeguards.

3. Alibaba (Netherlands) B.V.

Alibaba (Netherlands) B.V. Herengracht 448 NL-1017 CA Amsterdam Netherlands

Role

Data Importer (Processor under SCC Module Three / Sub-Processor in AKI.IO’s processing chain)

Purpose

Provision of AI inference services (Inference API); processing of user queries using open-weight models

Processing location

Singapore (actual technical processing performed by Alibaba Cloud (Singapore) Private Limited)

Type of processing

AI Inference (Art. 28 GDPR): Receiving/processing API requests, executing AI models, returning model responses

Categories of data

Input data (prompts/text), output data (AI responses), technical metadata (timestamps, model parameters)

Categories of data subjects

Employees, representatives, customers, suppliers and end users of AKI.IO Customers, as well as other individuals whose personal data is contained in Customer Content submitted for processing.

Trust Level

TL1

• Singapore Data Residency
• International operator

Retention and deletion

Retention in accordance with the provider terms identified in the applicable service configuration. Customer Personal Data is not used for model training, product improvement or other provider purposes. Any legally required retention is limited to the statutory purpose and period.

International transfers and safeguards

Alibaba (Netherlands) B.V. is the contractual Data Importer and Processor under the EU Standard Contractual Clauses. Customer Data is transferred from the European Economic Area to Singapore for processing by Alibaba Cloud (Singapore) Private Limited as further sub-processor. The applicable transfer mechanism is the European Commission Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914, Module Three (Processor-to-Processor), incorporated into the Data Processing Addendum. No separately dated transfer assessment is specified in the contractual documentation. Applicable safeguards include the technical and organisational measures incorporated through Annex II of the SCCs, confidentiality and access-control obligations, independent security audits and certifications, contractual restrictions on onward transfers, equivalent data-protection obligations for further sub-processors, and the data-use and retention restrictions set out in the Data Retention and Use Addendum.

203 StGB suitability

Not available.

4. Alibaba Cloud (Singapore) Private Limited

Alibaba Cloud (Singapore) Private Limited 51 Bras Basah Road, #03-06 Lazada One Singapore 189554, Singapore

Role

Further sub-processor on behalf of Alibaba (Netherlands) B.V. The entity that technically operates the infrastructure and processes data.

Purpose

Provision of AI inference services (Inference API); processing of user queries using open-weight models

Processing location

Singapore

Type of processing

AI Inference (Art. 28 GDPR): Receiving/processing API requests, executing AI models, returning model responses

Categories of data

Input data (prompts/text), output data (AI responses), technical metadata (timestamps, model parameters)

Categories of data subjects

Employees, representatives, customers, suppliers and end users of AKI.IO Customers, as well as other individuals whose personal data is contained in Customer Content submitted for processing.

Trust Level

TL1

• Singapore Data Residency
• International operator

Retention and deletion

Retention in accordance with the provider terms identified in the applicable service configuration. Customer Personal Data is not used for model training, product improvement or other provider purposes . Any legally required retention is limited to the statutory purpose and period.

International transfers and safeguards

Processing takes place in Singapore by Alibaba Cloud (Singapore) Private Limited as a further sub-processor and the actual processing entity for the Model Studio services. The EEA-to-Singapore transfer is covered by the international-transfer framework set out in the Data Processing Addendum, including the EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914, Module Three (Processor-to-Processor), applicable to the processing chain, together with the contractual requirements governing onward transfers to further sub-processors. No separately dated transfer assessment is specified in the contractual documentation. Applicable safeguards include the technical and organisational measures incorporated through Annex II of the SCCs, confidentiality and access-control obligations, independent security audits and certifications, restrictions on onward transfers, an obligation to impose at least equivalent data-protection requirements on further sub-processors, and the data-use and retention restrictions set out in the Data Retention and Use Addendum.

203 StGB suitability

Not available.

Section 2: Service providers and other recipients for AKI.IO’s own processing activities

1. EU VIES

European Commission – Directorate-General for Taxation and Customs Union (DG TAXUD) Rue de la Loi 200, 1049 Brussels, Belgium

Purpose

Validation of EU VAT identification numbers during Company Account registration; verification of B2B/customer tax status and determination of the applicable VAT treatment, including eligibility for the intra-EU reverse-charge mechanism.

Type of processing

Official VAT registry lookup via the European Commission's VAT Information Exchange System (VIES). The European Commission and the competent Member State tax administrations operate VIES on the basis of EU tax-administration legislation; this is not processing on behalf of AKI.IO pursuant to Art. 28 GDPR and no DPA with AKI.IO is required for the VIES lookup. Processing by EU institutions is governed principally by Regulation (EU) 2018/1725 rather than the GDPR itself. VIES queries the relevant national VAT registration systems.

Categories of data

Transmitted by AKI.IO in the minimal implementation: EU Member State/country code and VAT identification number to be validated. The API may return validity status, request date/reference and, depending on the Member State, registered business name and address. Optional requester VAT details and trader details need not be transmitted for a basic validation and should be omitted by AKI.IO unless specifically required.

Categories of data subjects

Customers of AKI.IO GmbH providing an EU VAT identification number. Where the VAT identification number or returned registry information relates to an identifiable natural person, such as an individual entrepreneur, the information may constitute personal data.

2. Google Ads – Google Tag and Conversion Tracking

Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland

Purpose

Measurement of Google Ads campaign performance; attribution of website conversions to advertising interactions; optimisation of advertising campaigns; and, where enabled, creation of audiences for remarketing.

Type of processing

Consent-based advertising and conversion tracking pursuant to Art. 6(1)(a) GDPR and, where applicable, Section 25 TDDDG. AKI.IO uses a dedicated Google tag / Google Ads conversion tracking integration and not Google Tag Manager. For standard Google Ads conversion tracking, AKI.IO and Google process the relevant data as independent controllers under the Google Ads Controller-Controller Data Protection Terms. The Google tag and associated advertising functionality must only be activated after the website visitor has provided the required consent.

Categories of data

IP address; browser and device information; timestamps; page views and URLs; referrer information; advertising interaction and advertising click identifiers; cookie identifiers and other online identifiers; conversion events and associated event data; information required to attribute a conversion to a Google advertising campaign.

Categories of data subjects

Visitors to the AKI.IO website who have consented to Google Ads tracking, including visitors who reached AKI.IO through or interacted with Google advertising.

3. GitHub – Identity Provider (SSO)

GitHub B.V. Prins Bernhardplein 200, 1097 JB Amsterdam, Netherlands

Purpose

Optional third-party identity provider for user registration, authentication and sign-in to the AKI.IO platform using an existing GitHub account.

Type of processing

Authentication via third-party identity provider using OAuth. GitHub authenticates the user directly under its own responsibility and acts as an independent controller for the processing associated with the GitHub account and authentication service. GitHub is not engaged by AKI.IO as a processor pursuant to Art. 28 GDPR for this processing. AKI.IO receives the authentication result and the account information made available through the selected sign-in method. AKI.IO does not receive or store the user’s GitHub password. Dominant legal basis for AKI.IO’s processing: Art. 6(1)(b) GDPR.

Categories of data

Provider-specific user identifier; email address; email-verification status; and profile information made available through the selected sign-in method, such as name, username or profile image. Authentication-related technical data is exchanged as required for the OAuth authentication process.

Categories of data subjects

Users of the AKI.IO platform who voluntarily choose to register or sign in using their GitHub account.

4. Google – Identity Provider (SSO)

Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland

Purpose

Optional third-party identity provider for user registration, authentication and sign-in to the AKI.IO platform using an existing Google account.

Type of processing

Authentication via third-party identity provider using OpenID Connect/OAuth. Google authenticates the user directly under its own responsibility and acts as an independent controller for the processing associated with the Google account and authentication service. Google is not engaged by AKI.IO as a processor pursuant to Art. 28 GDPR for this processing. AKI.IO receives the authentication result and the account information made available through the selected sign-in method. AKI.IO does not receive or store the user’s Google password. Dominant legal basis for AKI.IO’s processing: Art. 6(1)(b) GDPR.

Categories of data

Provider-specific user identifier; email address; email-verification status; name and profile image made available through the selected sign-in method. Authentication-related technical data is exchanged as required for the OpenID Connect/OAuth authentication process.

Categories of data subjects

Users of the AKI.IO platform who voluntarily choose to register or sign in using their Google account.

5. IONOS Email Services

IONOS SE Eigendorfer Str. 57, 56410 Montabaur, Germany

Purpose

Provision and hosting of business email services for AKI.IO; sending, receiving and storing business, contractual, support and operational email communications.

Type of processing

Processor pursuant to Art. 28 GDPR. IONOS processes email content, mailbox data and associated communication metadata on behalf of AKI.IO for the provision, hosting, transmission and administration of the email service. IONOS acts as an independent controller for data required for its own contractual relationship with AKI.IO, including customer account, billing, security and legally required records.

Categories of data

Email addresses and names of senders and recipients; email content; subject lines; attachments; timestamps and communication metadata; mailbox and account identifiers; technical connection and security data such as IP addresses and log data.

Categories of data subjects

Employees and representatives of AKI.IO GmbH; customers and users; prospective customers; suppliers, service providers and business partners; applicants; and other persons communicating with AKI.IO by email.

6. LinkedIn Ads – Insight Tag and Conversion Tracking

LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland

Purpose

Measurement of LinkedIn advertising campaign performance; attribution of website conversions to LinkedIn advertising interactions; website audience measurement; campaign optimisation; and, where enabled, creation of audiences for remarketing.

Type of processing

Consent-based advertising and conversion tracking pursuant to Art. 6(1)(a) GDPR and, where applicable, Section 25 TDDDG. The LinkedIn Insight Tag collects information directly from consenting visitors to the AKI.IO website. LinkedIn processes the information received through its advertising services under its own responsibility as an independent controller; the standard Insight Tag is therefore not an Art. 28 GDPR processor relationship between AKI.IO and LinkedIn.

Categories of data

IP address; URL and page views; referrer URL; timestamp; browser, device and user-agent information; website interaction and conversion event data; cookie identifiers, advertising identifiers and other online identifiers; information about interactions with LinkedIn advertising.

Categories of data subjects

Visitors to the AKI.IO website who have consented to LinkedIn advertising tracking, including LinkedIn members and other visitors who interact with AKI.IO following LinkedIn advertising.

7. Mollie B.V.

Mollie B.V. Keizersgracht 126, 1015 CW Amsterdam, Netherlands

Purpose

Payment processing for the AKI.IO platform; account management (SEPA direct debit, credit card); refund processing.

Type of processing

Independent controller pursuant to Art. 4(7) GDPR for payment processing. Mollie processes payment and transaction data under its own responsibility as a regulated payment service provider, including for the execution of payment transactions, fraud prevention, security and compliance with regulatory obligations.

Categories of data

Transmitted by AKI.IO: pseudonymized customer reference, payment amounts (EUR), internal payment/invoice IDs. Entered directly by the customer on Mollie’s platform: payment instrument data (credit card information, IBAN, account holder’s name). Email addresses, plaintext names, or other directly identifying characteristics are not transmitted to Mollie.

Categories of data subjects

Paying customers of AKI.IO GmbH.

8. Social Media Profiles – LinkedIn and Bluesky

LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland

Official AKI.IO profile: https://www.linkedin.com/company/aki-io/

Bluesky Social, PBC

Official AKI.IO profile: https://bsky.app/profile/aki-io.bsky.social

Purpose

Operation of AKI.IO’s official social media profiles; publication of company, product and industry information; communication and interaction with followers, customers, prospective customers, partners and other interested persons; and evaluation of engagement with published content.

Type of processing

AKI.IO processes personal data in connection with the administration of its social media profiles, publication of content and direct interaction with users pursuant primarily to Art. 6(1)(f) GDPR.

The respective platform providers process personal data under their own responsibility for the operation of their platforms, user accounts and related services.

For LinkedIn Page Insights relating to users in the EEA or Switzerland, AKI.IO and LinkedIn Ireland Unlimited Company act as joint controllers pursuant to Art. 26 GDPR in accordance with LinkedIn’s Page Insights Joint Controller Addendum.

Bluesky Social, PBC acts as an independent controller for the personal data it processes in connection with operation of the Bluesky platform. AKI.IO does not engage Bluesky as a processor pursuant to Art. 28 GDPR.

Categories of data

Public profile information; usernames and account identifiers; posts, comments, reactions and other interactions with AKI.IO content; messages and other communications sent to AKI.IO; follower and engagement information; and aggregated or statistical information made available by the respective platforms.

Categories of data subjects

Users of LinkedIn or Bluesky who visit, follow or interact with AKI.IO’s official profiles or communicate with AKI.IO through the respective platform.

International data transfers

The platform providers may process personal data outside the EEA. Such transfers are governed by the respective provider’s privacy documentation and applicable transfer mechanisms.

9. Zoom Video Conferencing

Zoom Communications, Inc. 55 Almaden Blvd., Suite 600, San Jose, CA 95113, USA

Purpose

Provision of video and audio conferencing for internal meetings, customer and prospective-customer meetings, partner communication, interviews, workshops and other business communications.

Processing location

European Union for meeting content and real-time communications under AKI.IO’s configured Zoom data center and data residency settings.

Type of processing

Processing on behalf of AKI.IO pursuant to Art. 28 GDPR: Zoom processes Customer Personal Data on behalf of AKI.IO for the provision and operation of video-conferencing services. AKI.IO has configured the available data center and data residency settings for processing of meeting content and real-time communications within the European Union. Zoom may act as an independent controller for a limited set of its own legitimate business purposes, such as account administration, billing, fraud and abuse prevention, legal compliance and service security, as specified in the Zoom Global Data Processing Addendum.

Categories of data

Participant name and display name; email address and other profile information where provided; IP address, device and connection information; meeting metadata and participation data; audio and video streams; screen-sharing content; chat messages, reactions and files shared during meetings. Meeting recordings, transcripts and related content are processed only where the relevant recording or transcription functionality is enabled.

Categories of data subjects

Employees and representatives of AKI.IO GmbH; customers and users; prospective customers; applicants; suppliers, partners and other participants invited to Zoom meetings hosted by or involving AKI.IO.

International data transfers

AKI.IO has configured Zoom for EU-region processing of meeting content and real-time communications. Where personal data is nevertheless transferred outside the EEA in connection with permitted service exceptions, account administration, support, security or other operational purposes, Zoom relies on applicable transfer mechanisms, including the EU-U.S. Data Privacy Framework and, where applicable, the European Commission’s Standard Contractual Clauses.

Section 3: Note on open-source software

AKI.IO uses self-hosted open-source software for the following purposes. As this software is operated on infrastructure controlled by AKI.IO, its use does not in itself involve disclosure of personal data to an additional external service provider or sub-processor.

• Internal chat
• Email clients and calendar
• Content Management Systems (CMS) for website and blog
• Website Analytics
• File management
• Project management
• Customer Service
• Customer Relationship Management (CRM)
• Agentic AI systems