⚠️ Provisional version — under legal review. This document will be finalised before launch.
Sub-processors
Last updated: {{EFFECTIVE_DATE}}
Octo Services is an intermediary marketplace that connects clients with professional service providers in Spain and the wider EU. To operate the platform, {{COMPANY_LEGAL_NAME}} ("Octo", the data controller) relies on a limited number of third-party providers that process personal data on Octo's behalf. In line with Article 28 GDPR, each is bound by a data processing agreement (DPA) requiring it to process data only on our documented instructions, apply appropriate security measures, and assist with data-subject rights.
This page lists our current sub-processors and is kept up to date. Questions: {{DPO_EMAIL}}.
Current sub-processors
| Sub-processor | Purpose / role | Data location | Safeguard |
|---|---|---|---|
| Supabase | Primary database (Postgres) — accounts, requests, quotes, all business data | EU | DPA; EU region |
| Vercel | Application hosting and serverless functions | EU | DPA; EU functions region |
| Cloudflare R2 | Object storage — identity/insurance documents, quote PDFs | EU | DPA; EU-jurisdiction bucket, private + presigned access |
| Brevo | Transactional email (account, notifications) | EU (France) | DPA; EU data centres |
| Stripe Payments Europe | Payment processing for provider fees (lead unlock, service fee, premium) | EU (Ireland) | DPA + SCC |
| Inngest | Background job orchestration (dispatch, timers, dunning) | EU where available | DPA; jobs carry IDs, not raw PII |
| OpenAI | AI extraction of amounts/quantities from uploaded provider quotes | United States | DPA + EU-U.S. Data Privacy Framework / SCC; zero-retention configuration |
Supabase Realtime (chat and notifications) is part of the same Supabase EU project and is not a separate processor.
Data residency
All sub-processors except OpenAI process personal data within the EU/EEA. OpenAI is our only non-EU sub-processor. Transfers to it are covered by a DPA relying on the EU–U.S. Data Privacy Framework and Standard Contractual Clauses, and OpenAI is configured for zero data retention. We send only the uploaded quote image and the numeric fields we extract from it — never client names, contact details, or identity documents.
New sub-processors and objections
We may add or replace a sub-processor as the service evolves. When we do, we will update this page. Where required by our contracts or by law, we will give prior notice so that affected parties can object on legitimate data-protection grounds; if an objection cannot be resolved, the affected party may exercise the remedies set out in the applicable agreement or privacy policy.
Contact
Data-protection questions, including about sub-processors and international transfers, can be sent to our Data Protection Officer at {{DPO_EMAIL}}, or by post to {{REGISTERED_ADDRESS}}. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).