Subprocessor and Supplier List¶
Sub-processors of personal data and the Provider's suppliers relevant to the provision of the Product
Version: 1.0.0
Classification: Confidential
Owner: Managing Director, MAZEVAULT s.r.o.
Last Updated: 2026-05-01
Review Cycle: Quarterly and upon every change
1. Purpose¶
This document provides transparency of the processing and supply chain for the purposes of Art. 28 GDPR (DPA Art. 8 and Annex C), Art. 28–30 DORA and the supply chain requirements under Act No. 264/2025 Coll.
The Provider does not host Customer data
The Product runs in infrastructure operated by the Customer (on-premise or own cloud tenant). This infrastructure, database, HSM, key storage and network are neither sub-processors nor suppliers of the Provider — they are components managed by the Customer. Third-party services that the Customer integrates into the Product (Azure Entra ID, Azure Key Vault, AWS Secrets Manager, HashiCorp Vault, external certificate authorities, SIEM) are governed by the Customer's contracts with those third parties (List of Required Software Art. 2.2).
2. Sub-processors of Customer Personal Data (DPA Annex C)¶
| Sub-processor | Service | Place of processing | Status |
|---|---|---|---|
| MAZEVAULT s.r.o. (Company ID 24517194) | Upstream product diagnostics only upon escalation under DPA Art. 2.3 | Czech Republic / EU | Approved conditionally; no standard access to Customer Data |
| Other suppliers of the Partner | To be listed by the Partner before acceptance of the DPA, if it uses them to process the Customer's personal data | Per supplier | If not listed, no others are approved |
The Provider does not engage any further sub-processor for personal data processed on behalf of the Customer. It processes diagnostic materials exclusively in-house, in the EU.
3. Provider's Suppliers Relevant to the Provision of the Product¶
These entities do not process Customer Data or Security Assets. They are listed for the completeness of the Customer's register of information (DORA) and for supply chain assessment.
| Supplier | Service for the Provider | Location | Data | Relationship to the Customer |
|---|---|---|---|---|
| Server infrastructure provider for the license server (legal entity and location available on request at info@mazevault.com) | Hosting of the MazeVault license server (license.mazevault.com) | EU | License metadata of which the Provider is the controller (see Personal Data Protection, Section 2.1) | Indirect — the Customer's Product communicates with the license server (HTTPS) for license verification |
OLC Systems s.r.o. (GitLab, Harbor registry registry.mazevault.com) |
Source code management, builds (CI) and container image registry | Czech Republic | The Provider's source code and build artefacts; no Customer data; bound by contract and confidentiality | Indirect — origin of released versions and images |
| External development suppliers of the Provider | Contract development of parts of the Product | Czech Republic / EU | Source code; no Customer data; bound by contract and confidentiality, without access to Customers' production systems | Indirect |
4. Notification of Changes¶
| Change | Who notifies | Time limit | Customer's right |
|---|---|---|---|
| New or replaced sub-processor of the Customer's personal data | Partner (DPA Art. 8.1) | At least 30 days in advance | Reasoned objection within 15 business days; if the risk cannot be eliminated, termination of the affected service without penalty (DPA Art. 8.2) |
| Change of a Provider's supplier under Section 3 | Provider, by updating this document and notifying the Partner | At least 30 days in advance; in the case of an emergency change, without undue delay | Information on request |
5. Requirements for Sub-processors and Suppliers¶
The Partner concludes a written contract with sub-processors imposing at least the same personal data protection obligations (DPA Art. 8.3). The Provider requires from its suppliers under Section 3 contractual confidentiality, processing of personal data in the EU and, for infrastructure providers, contractual security assurances and EU location.