1. Overview
In accordance with Article 28 of the General Data Protection Regulation (GDPR), GreenTrust Engineering Consulting ("Data Controller") maintains a list of sub-processors engaged in the processing of personal data through the GreenTrust EUDR platform.
Section 2 lists the sub-processors that process personal data for the platform. Section 3 lists the other parties that receive personal data from the platform's servers or from users' browsers, and the external data services the platform queries. For each one we state the data it receives and where it is located.
2. Current Sub-processors
| Sub-processor | Purpose | Data Processed | Location | DPA Status |
|---|---|---|---|---|
| Auth0 (Okta)*.eu.auth0.com | User authentication, identity management, role-based access control | Email, name, password (Auth0 stores only a hash of it), login metadata, IP address, user agent | EU (Frankfurt); Okta, Inc. is based in the United States | Covered by Okta DPA |
| Appwrite Cloudfra.cloud.appwrite.io | Database hosting, document storage, file storage | All platform data: operator profiles, supplier data, geolocation, documents, audit logs | EU (Frankfurt) | Covered by Appwrite DPA |
| Hetzner Online GmbH | Application server hosting (Docker containers), server logs, daily backup archives | All data the application processes; web-server and application logs; the daily backup archives | EU | Covered by Hetzner DPA |
| Sendinblue SAS (Brevo)smtp-relay.brevo.com | Delivery of the platform's notification e-mails (account, approval, submission, document, DDS and support notifications) | Recipient e-mail address and the content of the message, which can include names, company names, DDS references, file names and support-ticket subjects | EU; Sendinblue SAS is based in France | To be confirmed |
| Google LLC (Gemini API)generativelanguage.googleapis.com | AI assistant in the operator and supplier dashboards, when the assistant is enabled | The text a user types into the assistant, up to 10 previous messages of the same conversation and the interface language. No other platform data is added. | United States | To be confirmed |
The platform can be configured to use OpenAI, L.L.C. (api.openai.com) or Anthropic, PBC (api.anthropic.com), both in the United States, instead of Google for the AI assistant. Such a change is a change of sub-processor (Section 4).
3. Other Recipients and External Services
The parties below receive personal data from the platform's servers or from users' browsers, or are queried by the platform without personal data.
| Recipient | Purpose | Data Received | Sent From | Location |
|---|---|---|---|---|
| World Resources Institute: Global Forest Watch Data API and LandMark data-api.globalforestwatch.orggis.wri.org | Deforestation, forest-cover and indigenous and community land checks of plots (EUDR risk assessment) | The outline of a plot (polygon or point) with a buffer around it, and date ranges. No names, e-mail addresses or account data. | Platform servers | United States |
| World Resources Institute: Global Forest Watch map tiles tiles.globalforestwatch.org | Deforestation-alert overlay (GLAD/RADD integrated alerts) on the assessment map of GreenTrust administrators | IP address, user agent, referring page, map area viewed | GreenTrust administrators' browsers | United States |
| Esri, Inc. (ArcGIS Online)server.arcgisonline.com | Satellite map imagery | IP address, user agent, referring page, map area viewed | Users' browsers | United States |
| OpenStreetMap Foundationtile.openstreetmap.org | "Streets" map tiles of the supplier form's plot map and of the administrators' assessment map | IP address, user agent, referring page, map area viewed | Suppliers' and GreenTrust administrators' browsers | United Kingdom |
| VITO NV (Terrascope)services.terrascope.be | ESA WorldCover land-cover overlay on the assessment map of GreenTrust administrators | IP address, user agent, referring page, map area viewed | GreenTrust administrators' browsers | EU (Belgium) |
| European Commission: EU Information System for due diligence statements (TRACES)eudr.webcloud.ec.europa.euacceptance.eudr.webcloud.ec.europa.eu | Filing operators' due diligence statements under Regulation (EU) 2023/1115. Direct filing from the platform is not switched on yet. | The statement: operator identity and contact details, commodities and quantities, geolocation of the plots. Producer names only if the platform is set to include them (off by default). | Platform servers | EU |
| Esri, Inc. (ArcGIS Living Atlas: Sentinel-2 10 m land cover time series of Impact Observatory, Microsoft and Esri)ic.imagery1.arcgis.com | Land-use history check of plots (EUDR risk assessment): the land cover of 2019-2020 and of the latest years | The bounds of fixed map squares of 0.1 degree (about 11 km) in which plots lie, the same for every plot in a square; never a plot outline or point. No personal data. | Platform servers | United States |
| World Bank (World Bank Open Data API)api.worldbank.org | Country governance indicators for the EUDR country risk assessment | Country codes only. No personal data. | Platform servers | United States |
Map positions of suppliers and operator headquarters are worked out on the platform's own servers from an offline copy of the GeoNames dataset; no external geocoding service is used.
4. Changes to Sub-processors
GreenTrust will notify data subjects and operators of any changes to the sub-processor list at least 30 days before a new sub-processor begins processing personal data. Notifications will be provided via email to registered operators and by updating this page.
If you object to the use of a new sub-processor, you may contact us within the 30-day notice period at the address below.
5. Safeguards
- Application hosting, the database, file storage, the identity service (an Auth0 EU tenant) and e-mail delivery are located in the EU. Auth0 is owned by Okta, Inc., a company based in the United States (see Privacy Policy Section 10).
- Personal data reaches recipients outside the European Economic Area in these cases: the AI assistant provider (United States), the World Resources Institute (United States), Esri (United States) and the OpenStreetMap Foundation (United Kingdom), as listed in Sections 2 and 3. Privacy Policy Section 10 describes each transfer and its safeguard.
- The platform's servers connect to the parties in Sections 2 and 3 over TLS (version 1.2 or newer): HTTPS, and SMTP with STARTTLS for Brevo. Users' browsers load map tiles over HTTPS.
- The data processing terms of each sub-processor are stated in the table in Section 2.
6. Contact
GreenTrust Engineering Consulting
Email: dpo@greentrust.eu