Introduction
This article answers the most common questions around anDREa's subprocessors in relation to processing personal data.
Summary
anDREa has no subprocessors other than the (sub)processors that the Tenant already uses.
Rationale
All data is stored and processed within the context of a Workspace. A Workspaces of a Tenant is created within a Microsoft Azure subscription of the Tenant. All these Microsoft Azure subscriptions are created by the Tenant under the Billing Account of the Tenant. If an organization has a Billing Account for Microsoft Azure then that organization agrees to the terms and conditions of Microsoft which includes
https://docs.microsoft.com/en-us/legal/gdpr. anDREa BV cannot provide Billing Accounts to Tenants.
In other words, for the data stored and processed in Workspaces, the Tenant already has an existing controller-processor relationship with Microsoft (and potential subprocessors of Microsoft); potentially via an intermediate.
anDREa provides a service to the Tenant's own Microsoft Azure subscription. This argument is supported by the fact that the Tenant fully determines the purpose and means of the data processing for the Tenant can at any given time change the means,
i.e. stop using myDRE (see
Offboarding and Exit Strategy).
The only personal data that is not stored and processed within the Microsoft Azure subscription of the Tenant are the user accounts (name, email and user self-service mobile). However, users are created under the instruction of a Tenant and are stored and processed on Microsoft Azure using resources residing in the Microsoft region called West Europe. All this falls under the same terms and conditions as
https://docs.microsoft.com/en-us/legal/gdpr. And the argument can be made that because user accounts are created and maintained on the instruction of the Tenant in Microsoft Azure and Microsoft is already a by the Tenant approved processor, anDREa B.V. makes use of a by the Tenant approved processor; hence there is no subprocessing taking place.