Third-Party Sub-Processors

Effective starting: September 24, 2025

Climateware engages the third-party entities listed below (each referred to as a “Sub-processor”) to process Customer Personal Data on behalf of Climateware customers and developers under contractual agreements that ensure each Sub-processor maintains Climateware’s data protection obligations in Climateware's Data Processing Addendum. Terms, such as “Personal Data”, “Customer Personal Data”, “Sub-processor”, “Cloud Products”, or “End User Personal Data” have the meanings as defined in Climateware's Data Processing Addendum, or Climateware's Customer Agreement, whichever applies.

Climateware conducts annual compliance assessments of its Sub-processors. When the engagement of a Sub-processor requires transferring Personal Data across legal borders, Climateware conducts Transfer Impact Assessments in accordance with Applicable Data Protection Laws for these data transfers. Climateware requires its Sub-processors to adopt and maintain appropriate technical and organizational measures to ensure that the sub-processing of Personal Data meets the standards required by Applicable Data Protection Law and the standard provided by Climateware’s Data Processing Addendum, as applicable.

The list below identifies Sub-processors engaged for each of Climateware’s generally available Products and related Support or Advisory Services. For each Sub-processor listed, the processing of Personal Data occurs only for the period during which the customer or developer uses the relevant service(s), and continues for the retention periods specified in the customer’s agreement with Climateware and in any applicable product documentation. Additional details regarding Sub-processor security measures can be found through the external links provided below.

Sub-Processor Name	Company Name	Service Provided	Purpose of Processing	Data Categories Involved	Location of Processing
Microsoft Azure	Microsoft Ireland Operations Limited	Cloud AI model hosting and inference services	AI-based text processing, natural language processing, content generation, and reporting support	Uploaded user files (XML, PDF, CSV, XLSX, DOC, PNG, JPG, etc.), organizational data (name, address, industry, website, size), facility data (name, address, type), report data (report name, type, language, period, selected facility and GHG/ISO scope), emission data (activity, facility, organizational details), user-generated content and queries submitted via the in-platform support assistant	Sweden
Featurebase	Featurebase OÜ (Estonia)	Feedback and feature management platform	Collecting, managing, and routing user feedback and feature requests to product department	User feedback text, user-associated metadata (e.g., email, system ID)	EU (varies based on Featurebase infrastructure)
Google Tag Manager	Google Ireland Limited	Analytics and tracking tool	Measuring user interactions within the application (clicks, navigation, behavior) to improve product performance	User activity logs, usage statistics, cookie-based anonymized behavioral data	Worldwide (Google data centers)
HubSpot	HubSpot Ireland Limited	CRM, sales and marketing automation, and customer success tools	Managing customer relationships, tracking sales processes, marketing automation, and customer success operations	Customer contact data (name, surname, email, phone), organizational details (company name, industry, country, address), communication records (meetings, calls, emails, support requests), sales and marketing activity data	EU (Dublin, HubSpot Ireland) and worldwide (HubSpot global infrastructure)
Amazon Web Services (AWS)	Amazon Web Services EMEA SARL (Germany)	Cloud infrastructure and storage services	Hosting the platform infrastructure, storing and processing data, and operating scalable services	User account data, organization and facility data, uploaded files for calculation, reporting, and emission data operational logs	Germany (eu-central-1, Frankfurt)
Mezmo (LogDNA)	Mezmo, Inc. (USA)	Log management and monitoring services	Centralized collection, searchability, and monitoring of application and system logs	Application logs (error messages, process IDs, service name, timestamps), organizational and facility data, calculation data (masked or anonymized if sensitive)	USA (Mezmo data centers)

Specifications

Microsoft Azure. User-uploaded report and calculation data are processed solely to provide AI-assisted analysis and recommendations. Data are not retained for model training and are used exclusively during inference (real-time processing).

Featurebase. User-submitted feedback and feature requests are processed within Featurebase and shared with the Carbondeck product team for product improvement.

Google Tag Manager. Used to monitor user behavior, detect issues, and support product optimization. No personally identifiable information is collected, only behavioral and technical usage data.

HubSpot. Used for CRM, sales and marketing automation, and customer success operations. Customer and user contact information, organizational data, and interaction records are processed through HubSpot.

Amazon Web Services (AWS). The platform infrastructure is hosted in AWS’s Frankfurt region (eu-central-1). AWS is used solely for secure hosting, data processing, scalability, and operational continuity. Data are not used for training and are retained only for processing and hosting purposes.

Mezmo (LogDNA). Application and system logs are transmitted to Mezmo for centralized storage and analysis. Any personal data contained in logs (e.g., email, user ID, filenames) are masked or anonymized. Processing purposes are limited to error detection, security monitoring, performance optimization, and operational observability.