Subprocessors

Last updated: October 2026

suPlay B.V. uses the following subprocessors to operate suPlay Poll. Each has a signed Data Processing Agreement (DPA) on file or a publicly-referenced DPA we have accepted. Every provider we are able to engage is listed here in advance and papered before it is engaged, so bringing a listed provider into service is not the addition of a subprocessor. Where we add a provider that is not already listed, customers acting as Controllers get at least 14 days’ notice by email — shorter where the change is required for security, service continuity or legal compliance, with the same right to object and to terminate pro-rata either way. You may subscribe by emailing privacy@suplay.nl.

Current subprocessors

Self-hosted services (not subprocessors)

A primary application database, a short-lived cache / coordination layer, and an optional large-language model are all operated by suPlay B.V. on its own infrastructure in the Netherlands. These components are not third-party subprocessors, and in normal operation no data leaves our infrastructure to a third party. The one exception is the EU-resident AI fallback described below, which is used only when the self-hosted model cannot serve a request.

AI processing runs on that self-hosted model by default. In normal operation no poll content, participant answer or question reaches a third party, because the self-hosted model serves every AI feature.

An EU-resident provider covers overflow and failure. Where the self-hosted model cannot serve a call — it is unreachable, or a large audience has filled its capacity and the alternative is leaving content unscreened — the request may be served by Mistral AI SAS (France), listed in the subprocessor table above. The platform calls that provider’s EU endpoint, so processing stays inside the EEA and no transfer outside it occurs. The software enforces this rather than only stating it: an endpoint outside the allowed EU list disables the cloud path entirely, and leaving the EEA deliberately requires a second, separate configuration flag that is not set. Under the terms applicable to our account the submitted content is not used to train any model, and is retained only for the time needed to return a response plus a limited abuse-review window.

Listing a provider is disclosure, not engagement. The table above names every provider the platform is able to engage, including ones marked Not configured, which receive nothing and are never contacted. We name a capability in advance rather than disclose it afterwards. A provider may only be configured once an Art. 28(3) agreement — and, for processing outside the EEA, the Standard Contractual Clauses — are in force, and the table states for each provider whether that is the case. Today the only configured cloud provider is the EU one, which is why no transfer outside the EEA occurs.

The cloud path is off unless we deliberately enable it: it requires both an explicit configuration flag and a key, so a key alone cannot cause participant text to leave our infrastructure. The inputs listed below are identical on both paths, and the limits on what is never sent apply equally to both.

AI availability is operated by suPlay at platform level. An account can switch AI processing off for the events it owns, and a team organization’s owner or administrator can switch it off for all of the organization’s events; while either is off, nothing from those events is sent to any model, ours or a provider’s. Otherwise, automated moderation of participant free text runs on submissions as part of delivering the service. The remaining features are initiated by the presenter, so the model receives their inputs only when the presenter uses them. The model receives:

• AI question suggestions — administrator-typed topic / question templates (no participant data).
• AI moderation — Q&A questions, Message Wall posts, open-text answers and answer reasons are submitted to a short classifier prompt to flag obvious spam / abuse before it reaches the moderator, as far as the classifier has capacity. Text it does not screen follows the event’s own approval settings, except that text our built-in word list marks as high-risk is held for the presenter’s approval.
• AI summary — approved open-text answers are submitted to a summarisation prompt when the presenter requests an AI summary; raw text is fenced and the model is instructed to treat it as untrusted data.
• AI translation drafts — a presenter-authored poll question, its description and its answer options are submitted to a translation prompt when the presenter asks for a draft translation (no participant data).

Inputs are processed transiently and are never used to train or fine-tune a model. On the self-hosted model there is no logging or retention beyond the request/response cycle; on the EU fallback described above, retention is the time needed to return a response plus that provider’s limited abuse-review window. Output is stored as an application-controlled artefact (moderation flag, generated summary, draft translation) on the same EU infrastructure.

Any AI provider we can reach is named in the subprocessor table above, with its location and transfer basis, and the no-training commitment applies to it. We would rather name a capability in advance than disclose it afterwards, so a provider appears there whether or not it is currently configured.

Subprocessor change notifications

Our Data Processing Agreement is in force for every account, signed or not. We announce these changes on this page and email the contact you nominate, at least 14 days before we add a subprocessor that is not already listed above. Bringing a listed provider into service is within the authorisation you already gave and is not an addition. Where a change is required for security, service continuity or legal compliance we may act on shorter notice, or immediately, and will inform you without undue delay. Either way you may object on reasonable grounds within 14 days; we will seek a resolution in good faith and, failing that, you may terminate the affected subscription pro-rata. See DPA §7 — this page and that clause say the same thing.

Questions or DPA requests: privacy@suplay.nl.