1. Overview
This document lists the sub-processors engaged by Clarvo Oy to provide the Services described in the Principal Agreement and the Data Processing Agreement (DPA). Clarvo maintains this list and will notify the Controller at least thirty (30) days prior to any changes.
2. Infrastructure
| Sub-processor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Microsoft Azure | Cloud hosting, compute, database, storage, CDN | Sweden Central — EEA | N/A (data remains in EEA) |
3. AI Services
Clarvo uses AI models for prompt interpretation, per-criterion evidence checks, profile enrichment and the Clarvo agent. Search, matching and ranking run on Clarvo's own algorithms on Azure Sweden Central. Clarvo limits the candidate data it shares with these providers to what is needed for each feature.
| Sub-processor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Microsoft (Azure OpenAI Service) | Prompt interpretation and per-criterion evidence checks | Global | EU SCCs; Microsoft DPA |
| Google LLC (Gemini API) | Clarvo agent (planning, shortlists, summaries), natural language understanding, and profile enrichment | Global | EU SCCs; Google Cloud DPA |
4. Communication & Integrations
LinkedIn, email and applicant tracking system (ATS) integrations are opt-in features that the Controller activates at their discretion.
| Sub-processor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Unipile SAS | LinkedIn and E-mail messaging integration (opt-in). Enables outreach via the Controller's own LinkedIn account or E-mail account. | France (Scaleway) — EEA | N/A (data remains in EEA) |
| SendGrid (Twilio Inc.) | User account authentication and transactional system notifications (e.g., password resets). Note: SendGrid is not used to process Candidate Data or send candidate outreach. | EU region — EEA | N/A (data remains in EEA) |
| Google LLC (Gmail API) | OAuth authentication for Gmail integration (opt-in). Email sequence sending. | EEA (EU data region) | EU SCCs; Google Cloud DPA |
| Merge API, Inc. | Read-only connection to the Controller's applicant tracking system (opt-in). Retrieves candidate and application records into the Services. | EEA (Merge EU environment, Stockholm); contracting entity in the United States | EU SCCs; Merge DPA |
5. Payments
| Sub-processor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription billing, invoicing | Ireland (EU entity) — EEA | N/A (Stripe Technology Europe, Ltd.) |
6. Analytics
Analytics tools are consent-based. Users may decline analytics cookies without affecting core platform functionality.
| Sub-processor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Google Analytics | Website and platform usage analytics (consent-based) | EEA (EU data region) | EU SCCs; Google Cloud DPA |
| Microsoft Clarity | User behavior analytics, heatmaps, session recordings (consent-based) | United States | EU SCCs; Microsoft DPA |
7. Opt-in Architecture
Clarvo's platform uses an opt-in architecture for integrations involving third-party data processing. The Controller's data protection exposure is limited to only the sub-processors relevant to the features they activate:
-
LinkedIn integration (Unipile): Facilitating candidate outreach and synchronization via connected email accounts and LinkedIn profiles. This processing only occurs if the user explicitly authenticates and connects their external email account or personal LinkedIn account. All data processed within EEA (France, Scaleway).
-
Gmail integration (Google): Only active when the Controller connects their Gmail via OAuth.
-
ATS integration (Merge): Only active when the Controller connects its applicant tracking system. The connection is read-only. Data read through it is Customer Personal Data, is not added to Clarvo's talent database, and is deleted from Merge when the Controller disconnects the integration.
-
Email outreach (SendGrid): Delivery of transactional system notifications (e.g., account confirmations, password resets) directed solely at Clarvo Users.
-
Analytics (Google Analytics, Microsoft Clarity): Consent-based. Declinable via cookie banner.
-
Applications connected by the Controller (API / MCP): AI assistants or other applications that the Controller connects to Clarvo are engaged by the Controller and are not Clarvo sub-processors, so they are not listed here. See Section 7.4 of the DPA.
8. Changes to This List
Clarvo will update this list and provide at least thirty (30) days' advance notice before engaging a new sub-processor, per Section 7 of the DPA.
Contact: info@clarvo.ai
