Annex 3 to the Data Processing Agreement (DPA)
List of Sub-Processors

Title, registration number, contact information of sub-processor/ 	Personal data processing carried out by subprocessor (including, activity, role, information whether all Personal data processed or part of them) 	Place of processing (including, access and storage of Personal data) 	If Personal data processed outside of EU or EEA, what legal ground for transfer is applied and what safeguards applied (e.g., adequacy decision of EU, EU standard contractual clauses, Privacy Shield etc.)  
 	Security measures applied for processing and protection of Personal data (encryption etc.) 	
Google Cloud 
 
Google Cloud 
EMEA 
Limited, 70 Sir John Rogerson’s 
Quay, Dublin 
2 , Ireland 	-Cloud services - storage and processing for core business.  - All personal data 	Physical: Finland 		https://cloud.google.com/se curity  	
Sendgrid/ Twilio Inc. 
 
Twilio Inc., a Delaware corporation, with a place of business at 101 Spear Street, 
1st Floor, San 
Francisco, 
California, 
94105, United 
States of 
America 
 
www.sendgrid. com  	-Email delivery platform that enables to send and manage email communications. Creation of email campaigns. Also bounce handling, unsubscribe management, and IP warmup. 
 
-E-mail address -E-mail content incl. First/Last name most often 
-Received / Opened / 
Clicked data 	 	US (Contract made before 03.08.2021) 	Revised DPA https://www.twilio.co m/en-us/gdpr  
 	SOC 2 Type 2 (Trust 
Service Principles: Security 
& Availability) 
 
PCI DSS Level 4 
 
TLS v1.1 or higher for emails in transit between Customer’s software application and the recipient’s email server. 
 
Security overview: https://www.twilio.com/leg al/security-overview  	
Directo 
 
Directo OÜ Local business registry code 10652749; address Mõisa 4, Tallinn, 
13522 Estonia 
www.directo.e
e  	Used for automating financial processes, such as invoicing, expenses, and bookkeeping.  	Estonia and EU 	 	ISO 27001:2013 
 	
Everypay  
 
Everypay AS 
Local business registry code 12280690, 	Payment services and solutions. It allows to accept payments from customers through various channels, such 	Estonia and EU 		EveryPay payment platform is PCI DSS level 1 certified. 	

address: VäikeKarja 12, 
10148 Tallinn, 
Estonia 
 
www.everypay.com  	as credit cards, debit cards, bank transfers 		 		
LHV 	Banking service provider 	Estonia and EU 		Licensed bank 	
Vero 
 
Vero Holdings 
Australia Pty 
Ltd. 251 Riley Street Sydney, New 
South 
	Wales2010 	 	Customer relationship management (CRM) tool.  

•	First name, Last name 
•	Email 
•	Customer ID 
•	Received / Opened / 
Clicked data 
•	Optional 
	 	data  	Australia, US 	DPA  
SCC 
Revised 15.02.2023 	SOC 2 
 
All databases are encrypted at rest, applications encrypt in transit with TLS/SSL only. 
 
https://www.getvero.com/secu  rity/  	
Google Ireland 
Ltd 
(Ads, 
Analytics, Tag 
Manager) 	•	Data gathered from Google login 
•	First name  (from exports for exclusions 
purposes) 
•	Last name 
(from exports for exclusions 
purposes) 
•	Email (from 
exports for exclusions purposes 
 
Customer 
Communications 
Branding Marketing ad campaigns 	 	Parent: US EU body: 
Ireland 	https://business.safety .google/adsprocessort
	erms 	/  	https://business.safety.goog le/data-safety/marketersand-publishers/  	
Meta Platforms Ireland Ltd 	•	First name 
•	Last name 
•	Email 
Exclusion purposes for our marketing campaigns if needed 	 	Parent: US EU body: 
Ireland 	Stadard terms (DPA 
SCC) 
 	https://www.facebook.com/ business/gdpr  	
Helpscout 	Platform is used to communicate with Users. 
 	US 	DPA SCC 	https://www.helpscout.com /company/legal/security/ 	
	User data, which is provided by User itself. E-mail, name, phone number, PIN, 
transaction data (ticket 
number) 				
Freshdesk 
 
Freshworks Inc. (US). Contact: 
 
Tower B, 5th floor c/o CoWrks New 
Indiranagar 
Swamy 
Vivekananda 
Road, 
Sadanandanaga r, 
Bennigana 
Halli, 
Bengaluru - 560 016 	User communication (mostly chat). Will be closed 27th of July 2023. 
 
User data, which is provided by User itself. E-mail, name, phone number, PIN, transaction data (ticket number). 	India 
US 	DPA  SCC 	Freshworks encrypts personal data at rest and in transit protecting it from interception from US government surveillance agencies.  We use AES 256 
bit encryption for data at rest and HTTPS with TLS 1.2 encryption for data in transit, meaning that it will be intelligible to third parties.  We are also certified with ISO 27001 and undergo SOC 2 type 2 audit by independent third party firms. 

Signatures of the Parties:
On behalf of Controller
Riigi Kaitseinvesteeringute Keskus
Ivar Janson
/signed digitally/
 	On behalf of Processor
Stebby OÜ
Karl-Eduard Möldre
/signed digitally/