Subprocessors

Last updated: 2026-10-16 · v5.0

suPlay BV uses the following subprocessors to operate the Supplier Satisfaction Analysis Platform. This page has three parts: the general subprocessors below; the AI processing subprocessors that may receive survey aggregates when a report is generated; and the self-hosted services that suPlay BV operates itself and which are therefore not subprocessors at all.

Every subprocessor that actually processes data for us is engaged under a written data-processing agreement meeting the requirements of Art. 28(3) GDPR, and — where it processes data outside the European Economic Area — under the European Commission’s Standard Contractual Clauses. Providers listed below as not configured process nothing for us and are not engaged: putting that paperwork in place is a precondition of configuring one, not a description of today. Because every provider we can engage is listed here in advance and papered before it is engaged, bringing a listed provider into service is not the addition of a subprocessor. Where we add a provider that is not already listed, DPA customers get at least 14 days’ notice by email, or shorter notice where the change is required for security, service continuity or legal compliance — with the same right to object and to terminate pro-rata either way (DPA §7). You may subscribe to notifications by emailing privacy@suplay.nl.

AI processing subprocessors

The platform can draft the narrative sections of a survey report, and can translate questionnaire text between English, Dutch and German. Both features send a prompt to a large language model.

By default the model is self-hosted. Both features are served by a language model that suPlay BV runs on its own hardware (listed under “Self-hosted services” below), so in the normal case no third party is involved. Questionnaire translation has no fallback at all — if the self-hosted model is unreachable, translation fails with an error rather than being routed to a third party.

Report generation may fall back to a cloud AI provider. If the self-hosted model is unreachable, report generation automatically uses the first configured provider in the table below, in the order shown. The failover is automatic and is not announced in the interface — which is exactly why every provider the platform can reach is named here in advance and authorised as a subprocessor under DPA §7. Using a provider already listed here is therefore not the addition of a subprocessor. If no cloud provider is configured, report generation fails instead of falling back.

The cloud fallback is EU-resident by design, not by preference. Where a cloud provider is used it is Mistral AI SAS (France), and the platform is configured against that provider’s EU endpoint so processing stays inside the EEA. Under the terms applicable to our account the submitted content is not used to train any model, and is retained only for the time needed to return a response plus a limited abuse-review window.

A non-EU provider is kept dormant as a last resort. Anthropic PBC (Claude) remains in the table below because we want the capability named in advance rather than disclosed afterwards — for example if the platform is later operated for customers outside the EU. It is reached only when no Mistral key is set, never in preference to it, and it may not be configured at all until an Art. 28(3) agreement and the Standard Contractual Clauses are in force. That ordering is enforced in the software, not merely stated here.

Since 16 October 2026 the cloud fallback is OFF by default. The EU provider is configured, but it is reached only while the platform administrator has switched the fallback on, and only when the self-hosted model cannot serve a request. It is currently switched off, so no survey data leaves suPlay’s own systems and report generation fails rather than falling back. Every change of that switch is recorded in the platform’s audit trail. Anthropic remains unconfigured — no API key is set for it on production, so it is never contacted. Questionnaire translation still has no cloud path at all and fails rather than falling back. Changing provider is a change to this table, not to the design described here.

What reaches a model

The prompt is identical on the self-hosted path and the fallback path. It contains:

• The buying firm’s name.
• The number of completed responses, and per dimension the mean score, the number of respondents and the standard deviation.
• The questionnaire item texts, truncated to 50 characters, each with its mean score.
• For a Preferred Customer Assessment only: the names of the rated supplier organisations, grouped by the matrix quadrant they fall into (at most six names per quadrant). No score is attached to an individual supplier name.

What never reaches a model

• No individual response. Scores are aggregated across respondents before a prompt is built, so no answer is attributable to an identified individual, whatever the survey’s anonymity setting.
• No free-text or open-ended answer, in any form. Only numeric answers enter the statistics that the prompt is built from.
• No respondent name, contact name, email address, invitation token, access code, IP address or credential.

Requirements we place on an AI provider

suPlay BV will not configure a cloud AI provider unless, under the terms applicable to our account, that provider:

• acts only as a processor, on our instructions;
• does not use the submitted content to train or improve its models;
• retains the submitted content only as long as needed to return a response, plus a defined and limited abuse-review period; and
• is engaged under a data-processing agreement meeting Art. 28(3) GDPR, with the Standard Contractual Clauses where processing occurs outside the EEA.

Model output is a narrative draft: it is shown to the account’s own users for review and editing before it is used, and it produces no decision with legal or similarly significant effect on any individual within the meaning of Art. 22 GDPR.

Self-hosted services (not subprocessors)

The following services run on suPlay BV’s own infrastructure and are therefore operated by suPlay BV as controller / processor in its own right — they are not subprocessors and no third-party DPA applies. The database and queue run on the TransIP VPS (Netherlands); the language model runs on a separate suPlay-operated node reached over an outbound SSH reverse tunnel. Note that the self-hosted model is the default engine for AI report generation, not the only possible one — see “AI processing subprocessors” above for the fallback path.

Changelog

← Back