1. What is a sub-processor?
A sub-processor is a third party engaged by Darwin Data SAS to process personal data on behalf of our customers in the course of providing our nature-risk intelligence platform and services. We engage sub-processors only where necessary to deliver our services, and we require each of them to provide at least the same level of data protection and security that we commit to under our customer agreements and our Privacy Policy.
Each sub-processor is subject to a data processing agreement (DPA) that contains data protection obligations consistent with the GDPR, including appropriate safeguards for any transfer of personal data outside the European Economic Area (EEA).
2. Current sub-processors
The following table lists the sub-processors currently engaged by Darwin Data SAS.
| Sub-processor | Purpose / service | Data processed | Location / data residency |
|---|---|---|---|
| Amazon Web Services — hosting & Amazon Bedrock (Amazon Web Services EMEA SARL, Luxembourg / Amazon Web Services, Inc., USA) | Cloud hosting of the platform and database; managed large language model (LLM) inference via Amazon Bedrock. | All customer platform data; account identifiers; prompts and content submitted to AI features. | EU regions (Paris / Frankfurt). |
| Google Maps Platform (Google Cloud EMEA Ltd, Ireland / Google LLC, USA) | Geocoding and mapping of sites and assets. | Site addresses and geographic coordinates. | Google global infrastructure (EU endpoints where available). |
| Google Vertex AI (Gemini) (Google Cloud EMEA Ltd, Ireland / Google LLC, USA) | LLM inference (Gemini models) powering AI features. | Prompts and content submitted to AI features. | EU region (europe-west). |
| OpenAI (OpenAI, L.L.C., USA) | LLM inference (secondary AI provider) for selected AI features. | Prompts and content submitted to AI features. | USA — Zero Data Retention (ZDR) enabled: no storage or model training on submitted data. |
| Sentry (Functional Software, Inc., USA) | Application error monitoring and performance tracking. | Technical error logs and traces, IP addresses, technical identifiers. | Germany (EU data residency). |
| Mixpanel (Mixpanel, Inc., USA) | Product and website usage analytics. | Product usage events, device and technical identifiers, IP addresses. | EU (EU data residency). |
| Crisp (Crisp IM SAS, France) | Customer support live chat. | Support conversation content, contact details (name, email), IP addresses. | France. |
| Attio (Attio Limited, United Kingdom) | Customer relationship management (CRM). | Business contact details of customers and prospects (name, business email, company, role). | United States (data hosted on AWS US regions). |
| Notion (Notion Labs, Inc., USA) | Internal documentation and knowledge management. | Business documentation that may include customer contact details and notes. | USA. |
| Slack (Slack Technologies, LLC / Salesforce, Inc., USA) | Internal team communication. | Internal messages that may reference customer information. | USA. |
| Vanta (Vanta Inc., USA) | Continuous security and compliance monitoring. | Security and compliance metadata, personnel and account information. | USA. |
3. International transfers and safeguards
As a France-based company, we primarily process personal data within the European Economic Area (EEA). Where a sub-processor processes personal data outside the EEA, we implement appropriate safeguards, primarily through the execution of Standard Contractual Clauses (SCCs) approved by the European Commission, together with rigorous technical and organizational security measures.
4. Changes to this list
We keep this page up to date and update it whenever we add, remove, or replace a sub-processor. Customers under contract may request advance notification of changes to our sub-processors by emailing privacy@darwindata.ai.
5. Contact
For any question relating to our sub-processors or to the processing of personal data, please contact us at privacy@darwindata.ai.