Subprocessors pursuant to Data Processing Agreement

The Processor currently works with the following subcontractors and the Controller hereby agrees to their appointment.If data processing takes place outside the European Economic Area (EEA) or if access is made from outside the EEAw, the following overview must also list the measures and guarantees that ensure an appropriate level of data protection during processing in accordance with Art. 44 GDPR ff. (e.g. EU Standard Contractual Clauses, Binding Corporate Rules or other arrangements by the European Commission).

1. Amazon Web Services

Company: Amazon Web Services EMEA SARL

Address: 38 Avenue John F. Kennedy, L-1855 Luxembourg

Data processing activities: Data center used for hosting the Cozero application

Data location: Frankfurt zone

Guarantees: Certified according to EU-US Data Privacy Framework

‍

2. SendGrid

Company: Twilio Ireland Limited

Address: 70 Sir John Rogerson’s Quay, Dublin 2, D02 R296, Ireland

Data processing activities: User notification management and email delivery services for functionalities such as automated sign-up process, user communications or intercompany emission reporting

Guarantees: Certified according to EU-US Data Privacy Framework

‍

3. Intercom

Company: Intercom, Inc.

Address: 55 2nd Street, 4th Floor San Francisco, CA 94105 USA

Data processing activities: Customer feedback forms and other customer communication processes integrated into the application

Guarantees: Certified according to EU-US Data Privacy Framework

‍

4. Mixpanel

Company: Mixpanel, Inc.

Address: San Francisco, One Front Street, Floor 28, CA 94111, USA

Data processing activities: Product event analytics to optimize the product experience

Data location: Cozero uses Mixpanel's European data residency program, which allows the personal data collected to be fully processed and stored in Mixpanel's data center in the Netherlands.

Guarantees: Certified according to EU-US Data Privacy Framework

‍

5. MongoDB Limited

Company: MongoDB Limited

Address: MongoDB, Inc., 1633 Broadway, 38th floor, 10019 New York, USA

Data processing activities: Storing technical logs and events created by the application to analyze errors and processing times

Guarantees: Certified according to EU-US Data Privacy Framework

‍

6. HubSpot

Company: HubSpot, Inc.

Address: HubSpot, Inc., 25 First Street, Cambridge, MA 02141 USA

Data processing activities: Customer support center and other customer communication processes integrated into the application

Guarantees: Certified according to EU-US Data Privacy Framework

‍

7. IVE

Company: Ingenieurgesellschaft für Verkehrs- und Eisenbahnwesen mbH

Address: Ingenieurgesellschaft für Verkehrs- und Eisenbahnwesen mbH, Lützerodestraße 10D, 30161 Hannover, Germany

Data processing activities: Processing carbon accounting data when customers use our EcoTransIT integration

‍

8. Sentry

Company: Functional Software, Inc. dba Sentry

Address: Functional Software, Inc. dba Sentry, 45 Fremont St, 8th Floor, San Francisco, CA 94105, USA

Data processing activities: Processing and storing technical monitoring events

Guarantees: Certified according to EU-US Data Privacy Framework

‍

9. Snowflake

Company: Snowflake Computing Netherlands B.V.

Address: Snowflake Computing Netherlands B.V., FOZ Building, Gustav Mahlerlaan 300-314, 1082 ME Amsterdam, Netherlands

Data processing activities: Processing and storing changes made in our database and providing data for data heavy features in the application

Data location: Hosted on Amazon Web Services, data location Frankfurt am Main

Guarantees: Standard contractual clauses (processor-to-processor)

‍

10. HERE

Company: HERE Global B.V

Address: HERE Global B.V, Kennedyplein 222-226, 5611 ZT Eindhoven, Netherlands

Data processing activities: Geocoding and routing for services where the user provides addresses

‍

‍11. Anthropic

Company: Anthropic PBC

Address: 548 Market Street , PMB 90375 San Francisco, California 94104 United States

Data processing activities: Processing of user-submitted text inputs and structured data entries for AI-assisted product features within the platform, including but not limited to: automated generation of data processing logic, AI-supported data validation and classification, and natural language interaction for emissions data workflows.

Data Processing Location: 6th Floor South Bank House, Barrow Street, Dublin 4, Dublin, Ireland

Guarantees: Data is processed by Anthropic Ireland Limited as the contracting entity; onward transfer to Anthropic PBC (USA) cannot be excluded. To the extent that personal data is transferred onward to Anthropic PBC in the United States, such transfers are covered by Standard Contractual Clauses (SCCs) pursuant to European Commission Implementing Decision 2021/914 of 4 June 2021 (Module 3: Processor to Processor)

‍

12. Ingestro

Company: ComDocks GmbH

Address: ComDocks GmbH, Grimm 12, 20457 Hamburg

Data processing activities: Bulk validation and ingestion of customer data for any file based import features

‍