Subprocessor list

Decree uses one subprocessor. The entire platform runs from one data centre in France. No replication outside the EU, no US parent company, no CLOUD Act exposure.

Scaleway SAS is a French company with no US parent. The data centre in Paris is ISO 27001-certified. All data processing happens within the EU/EEA, and we use no subprocessor under US jurisdiction for any part of the platform.

None. Decree does not transfer personal data to countries outside the EU/EEA — not as part of operations, backup, support, or development. Should we later need to use a subprocessor outside the EU/EEA, we will ensure a lawful transfer basis (e.g. the EU Commission's Standard Contractual Clauses), update this list, and notify our customers prior to the change, cf. section 3.

When we want to add, replace, or remove a subprocessor, we notify all active customers at least 30 days before the change takes effect. Notification is by email to the customer's primary contact and by updating this page. The date of the most recent update is shown at the top of the page.

Customers may, within the notification period, object to the new subprocessor. If the objection cannot be resolved through dialogue, the customer is entitled to terminate the customer relationship without notice and without fee, cf. the signed Data Processing Agreement.

All active subprocessors are bound by a Data Processing Agreement under GDPR Art. 28, imposing on them at least the same obligations we undertake towards you as data controller. We can provide documentation of the underlying agreements on specific request.

Our standard Data Processing Agreement is available on request and is provided as standard at the start of a customer relationship.

Questions about this list or our choice of subprocessors can be directed to info@decree.dk. We respond without undue delay.