CostCare AI • MACH GROUP LLC, EDRPOU 45164108
This Subprocessor List (the “List”) contains information about third parties that LIMITED LIABILITY COMPANY “MACH GROUP”, Company Identification Code 45164108, registered address: Premises 1, 6/1 Stelmakha Street, Kyiv, 03040, Ukraine, operating under the CostCare AI trademark (the “Company”), may engage in the processing of personal data in connection with providing access to the CostCare AI software platform and related services.
This List applies together with the Data Processing Agreement (DPA) and the Public Offer for Access to the CostCare AI Software Platform and Related Services (the “Public Offer”).
1.1. For the provision, support, protection and operation of the CostCare AI software platform (the “Platform”), the Company may use third-party services, including providers of cloud infrastructure, data storage technologies, AI functionality, authentication, technical monitoring and other technology services.
1.2. For the purposes of this List, a sub-processor means a third party engaged by the Company to process personal data on behalf of the Client where the Company acts as a Processor in accordance with the DPA.
1.3. The specific sub-processors engaged in the processing of personal data of a particular Client may depend on the functionality of the Platform, the Client’s settings, the selected AI provider, connected integrations and other services actually used by the relevant Client.
1.4. The inclusion of a sub-processor in this List does not mean that such sub-processor has access to all personal data of all Clients of the Company. The scope and categories of data available to the relevant sub-processor depend on the nature of its services, the Platform settings and the Client’s actual use of the relevant functionality.
1.5. The Company engages sub-processors in accordance with the DPA and ensures that they are subject to contractual obligations concerning the protection of personal data in accordance with Applicable Law.
Function: cloud infrastructure, server resources, operation of the Platform and storage of backups.
Categories of data: Client Data and other information stored or processed within the Platform’s server infrastructure.
Primary infrastructure location: Frankfurt, Germany, AWS region eu-central-1.
The primary server infrastructure used by the Company to operate the Platform and backups of Client Data are located in Frankfurt, Germany.
Function: cloud database service used for the storage and processing of Platform data.
Categories of data: Client Data, account data, interaction history, information and other data stored or processed in the Platform database.
MongoDB Atlas is used by the Company as a cloud database service. The location of data processing and storage is determined by the MongoDB Atlas configuration used by the Company.
Function: provision of AI functionality through an API.
Categories of data: information necessary to process a specific request and generate a response, which, depending on how the Platform is used, may include message content, relevant interaction history, documents, files and other context to which the Client has provided access.
OpenAI is engaged in the relevant processing where the functionality of this AI provider is used to process the Client’s request.
Function: provision of AI functionality through an API.
Categories of data: information necessary to process a specific request and generate a response, which, depending on how the Platform is used, may include message content, relevant interaction history, documents, files and other context to which the Client has provided access.
Anthropic is engaged in the relevant processing where the functionality of this AI provider is used to process the Client’s request.
Function: provision of AI functionality through an API.
Categories of data: information necessary to process a specific request and generate a response, which, depending on how the Platform is used, may include message content, relevant interaction history, documents, files and other context to which the Client has provided access.
Google Gemini is engaged in the relevant processing where the functionality of this AI provider is used to process the Client’s request.
Function: provision of AI functionality through an API.
Categories of data: information necessary to process a specific request and generate a response, which, depending on how the Platform is used, may include message content, relevant interaction history, documents, files and other context to which the Client has provided access.
DeepSeek is engaged in the relevant processing where the functionality of this AI provider is used to process the Client’s request.
Function: authentication and authorisation of Platform users.
Categories of data: users’ email addresses and technical information necessary to provide authentication and authorisation.
PropelAuth is used to provide user authentication and authorisation functionality and does not receive from the Company the content of Client Data processed within the core functionality of the Platform.
Function: technical monitoring, error diagnostics and ensuring the stability of the Platform.
Categories of data: technical identifiers, diagnostic information and other technical data that may be processed in the course of monitoring and diagnosing the operation of the Platform.
Such monitoring may involve technical identifiers that, in certain cases, may be linked by the Company to the relevant user or record.
3.1. The Client independently selects one of the AI providers supported by the Platform for the relevant AI agent, including OpenAI, Anthropic, Google Gemini or DeepSeek. The Company transmits data to the relevant AI provider only in connection with the Client’s use of the functionality of that provider.
3.2. In order to generate a response from an AI agent, information necessary to process a specific request may be transmitted to the relevant AI provider through an API, including message content, relevant interaction history, context, as well as information from files, documents or other sources to which the Client has provided access, where such information is necessary to generate the response.
3.3. The Company does not use personal data processed on behalf of the Client to train or fine-tune its own artificial intelligence models.
3.4. When engaging third-party AI providers, the Company uses the relevant APIs and configurations on terms intended to enable the processing of data without its use for training or fine-tuning publicly available models, to the extent provided for under the terms of the relevant provider.
3.5. The Company does not grant third-party AI providers any independent right to use Client Data to train or fine-tune their models for their own purposes.
3.6. The processing and retention of information by the relevant third-party AI provider are governed by the terms applicable to the relevant API, the configurations used by the Company and Applicable Law.
4.1. The primary server infrastructure used by the Company to operate the Platform is located in the AWS Frankfurt region, Germany, eu-central-1.
4.2. Backups of Client Data are also stored on infrastructure located in Frankfurt, Germany.
4.3. The use of certain AI providers and other sub-processors may involve the processing or transfer of personal data outside the European Economic Area.
4.4. Where the GDPR requires a specific international data transfer mechanism for a relevant transfer, the Company shall ensure that an appropriate mechanism is implemented in accordance with Chapter V of the GDPR, including, as applicable, an adequacy decision, Standard Contractual Clauses (SCCs) approved by the European Commission and/or another mechanism permitted by Applicable Law.
4.5. Upon the Client’s reasonable request, the Company shall provide information about the applicable international personal data transfer mechanism to the extent necessary to demonstrate compliance with Applicable Law.
5.1. PayPro Global is used in connection with the acceptance and processing of payments as a Merchant of Record.
5.2. Payment information necessary to make a payment is provided by the user directly to the relevant payment provider.
5.3. The Company does not receive or store payment card numbers, CVV/CVC codes, cardholder names or other complete payment credentials provided by the user directly to the relevant payment provider.
5.4. PayPro Global is not automatically designated by this List as a sub-processor in respect of all processing operations involving Client Data. Its status in relation to a specific personal data processing operation is determined based on the nature of the relevant operation and the applicable PayPro Global terms.
6.1. The Client grants the Company general authorisation to engage sub-processors necessary for the provision of the Platform and related services in accordance with the DPA.
6.2. The Company shall notify the Client of any intended engagement of a new sub-processor or replacement of an existing sub-processor before such new sub-processor begins processing personal data by updating the current List on the Company’s website and/or by sending a notice to the Client’s email address.
6.3. The Client may, within 10 calendar days from receipt or publication of the relevant notice, raise reasoned objections relating to the protection of personal data.
6.4. If a reasoned objection is received, the Parties shall cooperate in good faith to resolve it.
6.5. The current version of this List shall be published by the Company electronically and shall indicate the date of its latest update.
7.1. This List applies together with the DPA and the Public Offer and does not alter the allocation of rights, obligations and liabilities between the Company and the Client established by the DPA and the Public Offer.
7.2. In the event of any conflict between this List and the DPA regarding the processing of personal data on behalf of the Client, the provisions of the DPA shall prevail.
7.3. This List may be updated by the Company to reflect changes in the sub-processors engaged, the technological infrastructure and the functionality of the Platform, subject to the procedure set out in the DPA and this List.
7.4. Questions regarding this List and the processing of personal data by sub-processors may be submitted to the Company using the contact details set out below.
LIMITED LIABILITY COMPANY “MACH GROUP”
Company Identification Code: 45164108
Registered Address: Premises 1, 6/1 Stelmakha Street, Kyiv, 03040, Ukraine
Trademark: CostCare AI
Email: wahtel@costcare.ai
Phone: +380 67 565 27 27