Sub-processors
Effective from 2026-08-01 — v1
In accordance with Article 28 of the GDPR, Prospectrum engages service providers (sub-processors) to deliver its service. Our customers (garages) grant us general authorization to use them; we notify them of any addition or replacement of a sub-processor not already named in the list below, with 15 days’ notice, which opens a right to object. This page is the official sub-processor list for Prospectrum.
Sub-processors — call data processing (on behalf of garages)
| Sub-processor | Role | Country | Transfer outside the EU |
|---|---|---|---|
| OpenAI | AI voice processing | United States (EU entity: OpenAI Ireland Ltd) | Standard Contractual Clauses + transfer impact assessment |
| Twilio | Telephony & SMS | United States / Ireland | EU-US Data Privacy Framework (Twilio Inc., certified) — SCCs as fallback |
| Scaleway | Hosting & storage | France | — |
| Gladia (Gladia SAS) | Speech recognition (transcription) for the cascade engine | France | Data localised in Europe — no transfer outside the EU under this service |
| ElevenLabs (ElevenLabs Ltd.) | Speech synthesis (the assistant’s voice) for the cascade engine | United States | EU-US Data Privacy Framework — SCCs as fallback |
| Voice bench — deemed pre-authorised, not activated: Deepgram | Alternative speech synthesis / recognition | United States / EU depending on region | SCCs + transfer impact assessment where applicable |
- OpenAI
- Role
- AI voice processing
- Country
- United States (EU entity: OpenAI Ireland Ltd)
- Transfer outside the EU
- Standard Contractual Clauses + transfer impact assessment
- Twilio
- Role
- Telephony & SMS
- Country
- United States / Ireland
- Transfer outside the EU
- EU-US Data Privacy Framework (Twilio Inc., certified) — SCCs as fallback
- Scaleway
- Role
- Hosting & storage
- Country
- France
- Transfer outside the EU
- —
- Gladia (Gladia SAS)
- Role
- Speech recognition (transcription) for the cascade engine
- Country
- France
- Transfer outside the EU
- Data localised in Europe — no transfer outside the EU under this service
- ElevenLabs (ElevenLabs Ltd.)
- Role
- Speech synthesis (the assistant’s voice) for the cascade engine
- Country
- United States
- Transfer outside the EU
- EU-US Data Privacy Framework — SCCs as fallback
- Voice bench — deemed pre-authorised, not activated: Deepgram
- Role
- Alternative speech synthesis / recognition
- Country
- United States / EU depending on region
- Transfer outside the EU
- SCCs + transfer impact assessment where applicable
Sub-processors — Prospectrum operations (business & website data)
| Sub-processor | Role | Country |
|---|---|---|
| Stripe | Subscription payment & billing | Ireland (EU) — US transfers covered by the EU-US Data Privacy Framework (Stripe, Inc., certified) |
| Brevo (Sendinblue SAS, RCS Paris 498 019 298) | Email delivery | France |
| Scaleway | Hosting | France |
| Website voice demo — same voice providers as the calls | Speech recognition, response generation and speech synthesis: see the table above. The demo runs in the browser, so no telephony is involved (no Twilio). Live audio stream, not recorded; transcript kept up to 90 days — see privacy policy | See the table above |
- Stripe
- Role
- Subscription payment & billing
- Country
- Ireland (EU) — US transfers covered by the EU-US Data Privacy Framework (Stripe, Inc., certified)
- Brevo (Sendinblue SAS, RCS Paris 498 019 298)
- Role
- Email delivery
- Country
- France
- Scaleway
- Role
- Hosting
- Country
- France
- Website voice demo — same voice providers as the calls
- Role
- Speech recognition, response generation and speech synthesis: see the table above. The demo runs in the browser, so no telephony is involved (no Twilio). Live audio stream, not recorded; transcript kept up to 90 days — see privacy policy
- Country
- See the table above
Notification policy — new sub-processors
Any addition of a sub-processor not already named in this list, or material change to an existing sub-processor's terms, is notified by email to affected customers, at the contact address on their account, at least 15 days before taking effect, in accordance with Article 28 §2 of the GDPR. Each notice states the version of this list that will come into force and its effective date. Customers may object within that period under the terms set out in Article 7 of the DPA.
Third-party recipients (separate data controllers)
These services are not our sub-processors: they act under their own responsibility.
- Vehicle licence-plate lookup API — not active at launch: plate lookup is disabled in production and no plate is transmitted to any third party. It will be activated after launch with a licensed SIV vendor (Dataneo WebSIV) under an Article 28 DPA, and listed here at that time.
- Google / Microsoft Calendar — connected by the garage via its own account (OAuth); this is the garage’s own system, not Prospectrum’s.
For any question or objection: contact@prospectrum.ai.