Sub-processors
A sub-processor is a company that processes a customer's data on LunoLake's behalf. This is the whole list. There is one supplier on it, and it is Microsoft: the platform runs in Azure, it is watched by Azure Monitor, and the mail it sends goes through Microsoft 365.
- Microsoft Ireland Operations Ltd.
Hosting and operation of the SaaS platform, Azure
EU, West Europe. Within the EU and the EEA under Microsoft's EU Data Boundary. - Microsoft Ireland Operations Ltd.
Application monitoring and error logging, Azure Monitor
EU, West Europe. Within the EU and the EEA under Microsoft's EU Data Boundary. - Microsoft Ireland Operations Ltd.
Transactional and notification email, Microsoft 365
EU. Within the EU and the EEA under Microsoft's EU Data Boundary.
Where the data is
Customer data is stored and processed within the EU and the EEA. Microsoft commits to that under its EU Data Boundary. Where Microsoft moves data outside it, for instance to answer a support request, it does so on the Standard Contractual Clauses in its own Data Protection Addendum, and LunoLake relies on those clauses rather than on any arrangement of its own.
One thing to be clear about, because it is the exception: if a customer asks the platform to copy its documents to storage the customer itself owns, the customer chooses where that storage is. LunoLake does not check the region, and a copy directed outside the EEA is the customer's own transfer to account for.
Adding one
LunoLake notifies each customer at least 30 days before adding or replacing a sub-processor, so that there is time to object with a reason. If an objection is justified and the two of us cannot find a way round it, the customer can bring its use of the affected part of the service to an end without being charged for it. A company that is not on this list is not used.
This is clause 7 and clause 15.4 of the data processing agreement, which every customer accepts directly with LunoLake and can download from the portal at any time.
Asking about it
Write to info@lunolake.com. We are not required to have a data protection officer and do not have one, so your message reaches us directly.