Subprocessors

This annex identifies providers for processing on behalf of the customer. Actual use depends on the commissioned functions and configuration. Authorization does not release Limetree Legal from its DPA duties, including contractual safeguards, data minimization and protection of professional secrets.

Infrastructure and communications

• Vercel Inc.: hosting, application execution, object storage, operational logs, workflows and AI Gateway. Data includes account, organization, matter, file, workflow and technical data, and inputs necessary for a commissioned AI function. Application execution is configured in Frankfurt; this does not mean that all services, support access or AI requests are processed exclusively in Germany. Provider established in the United States.
• PlanetScale, Inc.: PostgreSQL database and associated operations including backups. Data includes stored account, organization, matter and application data. Provider established in the United States; the agreed database region and additional access locations are communicated to Controller on request.
• Plus Five Five, Inc. (Resend): account, invitation, security and service email delivery. Data includes recipients, message metadata and necessary message content. Provider established in the United States; a European sending region alone does not exclude processing in the United States.
• API Hero Ltd (Trigger.dev): scheduled background jobs and associated task and runtime data where this function is used. Provider established in the United Kingdom. Processing regions and downstream infrastructure depend on the service configuration and must be assessed before a different processing location is enabled.

AI and research services

AI Gateway and research interfaces may forward data to other providers. Identifying a gateway alone does not authorize arbitrary downstream recipients. Client matter content may be sent only to providers previously identified and authorized under the DPA. Before such processing, Limetree Legal supplies a supplementary list with legal entity, purpose, data categories, processing locations and transfer basis. General-purpose model training using client matter content is not permitted.

External searches must be limited to necessary research terms. Non-public files, credentials and other secrets not needed for the research must not be submitted as search queries. Public registers such as DPMA, EUIPO and WIPO and systems connected directly by Controller do not become Limetree Legal subprocessors merely because an interface exists; their role depends on the relevant data flow.

Transfers and changes

Necessary international transfers require an applicable basis under Chapter V GDPR, such as a relevant adequacy decision or EU standard contractual clauses with necessary supplementary safeguards. A provider's place of establishment or certification does not replace assessment of the actual data flow. The additional protection under section 43e BRAO remains unaffected.

Intended additions or replacements are notified at least 30 calendar days before use. Objections and remedies follow the DPA. The version of this annex incorporated in an acceptance is permanently stored with the agreement. Questions about specific processing locations and contractual safeguards: support@limetreelegal.de.