Q-Meet Sub-processor List
Version 1.1 – Effective 15 September 2026
This Q-Meet Sub-processor List forms part of the Q-Meet Data Processing Agreement. It identifies all sub-processors used by QBIM to process Customer Personal Data within the Q-Meet processing chain as of the effective date.
The Customer grants QBIM general authorisation to engage the sub-processors listed below for the purposes specified, subject to the notice and objection process in the Q-Meet DPA.
| Sub-processor | Function | Data categories | Processing region | Third country | Transfer mechanism |
|---|---|---|---|---|---|
| Microsoft Ireland Operations Limited (Microsoft Azure) | Hosting, storage, backup, logging and QBIM-operated transcription | Account data; meeting audio, transcripts and product data; logs and backups | Primarily Sweden Central, Sweden; limited global support/sub-processor functions may occur | May occur | Microsoft Products and Services DPA; adequacy decision where applicable, otherwise SCC |
| Cloudflare, Inc. | Network, security and performance services | IP addresses, technical identifiers, traffic metadata and content passing through the service | Global network | Yes | Cloudflare DPA; DPF for eligible US processing where applicable, otherwise SCC |
| Google LLC (Firebase) | Identity/access management and selected platform functions | Account/authentication information and technical metadata | USA and EU/Europe depending on function | Yes | Google Cloud DPA; applicable adequacy mechanism or SCC |
| OpenAI Ireland Limited | AI-based text analysis and generation of meeting outputs | Text-based meeting information, prompts, outputs and technical metadata | EEA contracting party; processing outside EU/EEA, including USA, may occur | Yes | OpenAI DPA; adequacy decision where applicable, otherwise SCC |
| Mailgun Technologies, Inc. / Sinch Email | Email delivery of meeting summaries | Recipient address, email content and delivery metadata | EU region for message data; global account/support metadata may occur | May occur | Sinch Email DPA; SCC or other applicable Chapter V mechanism for non-adequate transfers |
1. Processing Principles
QBIM shall ensure that each sub-processor processing Customer Personal Data is contractually subject to data-protection obligations providing the protection required by Article 28 GDPR and the Q-Meet DPA. QBIM remains responsible towards the Customer for the performance of its sub-processors to the extent required by applicable law.
2. International Transfers
Where a sub-processor processes Customer Personal Data outside the EU/EEA, QBIM applies a valid Chapter V GDPR transfer mechanism. An applicable adequacy decision may be relied upon where available; otherwise SCC or another lawful mechanism is used together with relevant supplementary safeguards.
QBIM maintains a documented Transfer Impact Assessment for identified international Q-Meet transfers and reviews it at least annually and upon material changes.
3. Changes to Sub-processors
QBIM shall notify affected Customers at least 30 days before a material new sub-processor begins processing Customer Personal Data or a material change to existing sub-processor processing takes effect. The Customer may object during the notice period on reasonable and documented data-protection grounds. If no reasonable solution is available, the Customer may terminate the affected part of the Service before the relevant new processing begins.
4. Payment and App-store Providers
Payment processors and app-store platform operators used for purchases, billing or app distribution are not included in this list solely by reason of those activities where they do not process Customer meeting data on behalf of QBIM. Their processing of billing/store data is governed by the Q-Meet Privacy Policy and the applicable provider terms. Google is separately included above for its role as a Q-Meet sub-processor for identity/access and selected platform functions.