ChongCheck — Subprocessors List

This document lists the third parties ("Subprocessors") that ChongCheck OÜ uses to deliver the Service. Each Subprocessor processes personal data on our behalf under a signed Data Processing Agreement (DPA) and, where applicable, Standard Contractual Clauses (SCCs).

We publish this list as part of our transparency commitment and update it on at least 30 days' notice before adding or materially changing a Subprocessor that processes personal data.

---

1. How to Subscribe to Updates

Email privacy-updates@chongcheck.app with the subject "Subscribe subprocessors" to receive an email each time this list is updated. Alternatively, monitor the version history at chongcheck.app/legal/subprocessors/versions or the RSS feed at chongcheck.app/legal/subprocessors.rss.

---

2. Current Subprocessors

2.1 Cloud Infrastructure

2.2 AI Model Providers (inference only — no model training)

AI model providers do not train their own models on data submitted via ChongCheck. We use zero-retention or short-retention endpoints with explicit no-training clauses in DPAs.

2.3 Payments

2.4 Email & Notifications

2.5 Analytics & Observability

2.6 Support & Customer Service

2.7 Identity Verification (Vet Portal)

2.8 Compliance & Legal Tooling

---

3. Russian Federation Specifics

Because ChongCheck processes personal data of Russian Federation residents, primary storage of accounts of RU users is mirrored in Yandex Cloud (Moscow region) to comply with 152-FZ data-residency requirements. Cross-border processing for AI inference is conducted under separate explicit consent at signup.

---

4. Partners (not Subprocessors)

The following entities receive only aggregated, k-anonymous data under separate Data Processing Agreements and Non-Disclosure Agreements. They are not Subprocessors because they do not receive personal data.

See the AI Training & Research Data Notice for the explicit rules.

---

5. Removed Subprocessors

We list previously used Subprocessors below for full transparency. Data has been deleted or returned per contract.

(No removals yet — list will populate as the Service evolves.)

---

6. International Transfer Safeguards

For transfers outside the EEA / UK / Switzerland / Russia, we rely on:

• Adequacy decisions (Andorra, Argentina, Canada (commercial), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, UK, Uruguay) — direct lawful transfer.
• Standard Contractual Clauses (SCCs) — for transfers to other jurisdictions (notably US providers).
• Binding Corporate Rules — where the Subprocessor has them.
• Transfer Impact Assessment (TIA) — performed for each non-adequate-jurisdiction Subprocessor, reviewed annually or upon material change in the recipient jurisdiction's surveillance laws.
• Supplementary measures — encryption in transit and at rest; pseudonymization; strict access controls; data minimization at the Subprocessor; right-to-audit clauses.

---

7. Subprocessor Selection and Audit

Each Subprocessor is selected against:

• Adequate technical and organizational security (ISO 27001, SOC 2 Type II, or equivalent attestation; HIPAA-equivalent where relevant);
• Acceptable DPA terms (including SCCs where applicable, EU/UK addenda, no-training of own AI models on our data);
• Sub-subprocessor transparency (visibility into their own subprocessors);
• Breach notification (≤72 hours);
• Right to audit (with reasonable notice and proportionate scope);
• Termination rights if compliance lapses.

We review Subprocessor compliance annually and upon any material incident.

---

8. Right to Object

If you object to a new Subprocessor on reasonable grounds (e.g., a specific compliance concern), email privacy@chongcheck.app within the 30-day notice period. We will:

• Discuss the concern;
• Where reasonable, propose mitigations or an alternative;
• If no resolution is possible, allow you to terminate the affected Service for a pro-rated refund of any pre-paid period.

---

9. Contact

• Privacy team: privacy@chongcheck.app
• DPO: dpo@chongcheck.app
• Subscribe to updates: privacy-updates@chongcheck.app

---

This document is a draft pending review by qualified counsel. The list will be expanded and finalized at production launch; vendor names marked "(TBD)" or "where enabled" indicate pending selection or regional availability.