Sub-processors

Current sub-processors

• Swedbank Pay (PayEx Sverige AB) — payment processing. EU/EEA data processing, Swedish/EU-based provider (part of Swedbank group). Personal data transferred: the payer's name, email address, telephone number, billing details and payment reference. Full card numbers and CVC never pass through Frostmoln's systems; they are supplied directly by the payer to Swedbank Pay.

Hosting facilities

The platform equipment is colocated in facilities within the EU/EEA. The service supplied is premises, power, cooling and network connectivity. Processing personal data is neither the purpose of that service nor a key element of it: a facility operator is not given customer data, performs no operation on it, and has neither logical access to the platform nor any credentials. Storage media are encrypted at rest with keys held solely by Frostmoln, so any media leaving a facility cannot be read. Facility personnel have physical access to the racks; such access does not constitute processing of personal data on behalf of the customer. Facility operators are therefore not sub-processors within the meaning of Article 28 GDPR. The current facility operators are named in our supplier register, available on request.

Changes

We notify customers at least 30 days before adding or replacing a sub-processor, in accordance with Section 5 of the Data Processing Agreement, and update this list at the same time. If a sub-processor must be replaced urgently to maintain the security or continuity of the services, notice may be shorter, but it is always given before the new sub-processor begins processing personal data. We also notify customers at least 30 days before adding or changing a hosting facility.