Close
Earned wage access
Advanto People
Advanto People: List of Sub-processors
Advanto Group s.r.o.
This list of sub-processors (the “List”) supplements the Advanto People Data Processing Addendum (the “DPA”) and the Advanto People Platform Terms. It names the sub-processors within the meaning of section 7 of the DPA that Advanto Group s.r.o., company ID 08863032, with its registered office at Běhounská 5/18, Brno-město, 602 00 Brno, Czech Republic (“Advanto”), engages when it processes personal data on behalf of the Customer in the Advanto People platform (the “Platform”) and its services, including Erika. Capitalised terms have the meaning given to them in the DPA and the Platform Terms.
The List does not apply to the Advanto Výplata Kdykoliv service (earned wage access), which has its own list of processors.
1. Sub-processors of the Platform
1.1 Advanto engages the following sub-processors for all Customers of the Platform. Each sub-processor may process personal data only on Advanto’s instructions and to the extent necessary to provide its service.
| Sub-processor | Service / purpose | Categories of personal data | Location of processing and safeguards |
|---|---|---|---|
| Amazon Web Services EMEA SARL38 Avenue John F. Kennedy, L-1855 Luxembourg | Hosting of the Platform: application servers, databases, file storage (including documents, call recordings and transcripts), configuration, backups and application logs | All categories of personal data processed in the Platform | EU – Germany (Frankfurt, region eu-central-1); SCC / EU-US DPF for any access from a third country |
| Google Cloud EMEA Limited70 Sir John Rogerson's Quay, Dublin 2, Ireland | Firebase Authentication – sign-in and multi-factor authentication of users; Google Cloud Run – hosting of the service that runs AI chat and messaging agents | Users: e-mail address, authentication identifiers and credentials, phone number used for multi-factor authentication. Chat and messaging agents: name, phone number and message content | USA (authentication); EU – Belgium (hosting, region europe-west1); EU-US DPF / SCC |
| Twilio Ireland Limited70 Sir John Rogerson's Quay, Dublin 2, D02 R296, Ireland | SMS messages, telephone connectivity and phone numbers (Twilio); delivery of e-mail messages (Twilio SendGrid) | Phone number, content of SMS messages, call metadata (date, time, duration); e-mail address, name and content of e-mail messages | USA and EU – Ireland; EU-US DPF / SCC / Binding Corporate Rules |
| OneSignal, Inc.201 S. B St., Suite 200, San Mateo, CA 94401, USA | Delivery of push and e-mail notifications to users | User identifier, e-mail address, device push token, content of the notification | EU – Netherlands (hosting) and USA; SCC |
| OpenAI Ireland Limited1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland | AI functions of the Platform: reading and scoring of CVs, extraction of data from documents, translations, text search (embeddings), AI chat and messaging agents | Content of CVs and job applications, content of uploaded documents, content of messages; the data needed for the given function | USA; SCC |
| Functional Software, Inc. d/b/a Sentry45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA | Monitoring of errors and outages of the web application | IP address, device and browser type, visited address, technical data about the error | EU – Germany (Frankfurt); SCC / EU-US DPF for any access from a third country |
| Google Ireland LimitedGordon House, Barrow Street, Dublin 4, Ireland | Google Tag Manager – measurement of the use of the web application; Google Maps – map shown on public job pages | IP address, device and browser information, pages viewed | EU / USA; SCC / EU-US DPF |
| Digital Solutions, s.r.o. (DigiSign)Company ID 25998706, 17. listopadu 203, 530 02 Pardubice, Czech Republic | Electronic signing of documents, if the Customer uses e-signatures | Signer: name, e-mail address, phone number, date of birth; the documents being signed | EU – Czech Republic |
2. Sub-processors of Erika and of optional services
2.1 Advanto engages the following sub-processors only for Customers who use the service stated for each of them.
| Sub-processor | Service / purpose | Categories of personal data | Location of processing and safeguards |
|---|---|---|---|
| OpenAI Ireland Limited1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland | Erika – AI-assisted phone calls with candidates (real-time speech model), transcription of the call, analysis and scoring of the call | Voice and content of the call (audio, recording, transcript), phone number, name and the job-application data used in the conversation | USA; SCC |
| Twilio Ireland Limited70 Sir John Rogerson's Quay, Dublin 2, D02 R296, Ireland | Erika – telephone connection of the call and SMS messages sent to candidates | Phone number, call metadata (date, time, duration), content of SMS messages | USA and EU – Ireland; EU-US DPF / SCC / Binding Corporate Rules |
| Eleven Labs Inc.169 Madison Ave #2484, New York, NY 10016, USA | Erika – voice AI for phone calls with candidates. Being phased out: since November 2026 new calls are no longer routed to this provider; data from earlier calls remain stored with the provider until they are deleted | Voice and content of the call (audio, recording, transcript), phone number, name and the job-application data used in the conversation | USA; SCC / EU-US DPF |
| Merge API, Inc.353 Sacramento Street, San Francisco, CA 94111, USA | Synchronisation with the Customer’s applicant tracking system (ATS), if the Customer connects one | Candidates and job applications: identification and contact data, CVs and attachments, application status | USA; SCC |
| Meta Platforms Ireland LimitedMerrion Road, Dublin 4, D04 X2K5, Ireland | Sourcing campaigns: job advertisements with lead forms and replies to candidates in Messenger, if the Customer uses sourcing | Candidates who respond to an advertisement: name and contact data entered in the form, Meta user identifier, content of messages | EU / USA; EU-US DPF / SCC |
3. Services connected by the Customer
3.1 The following providers are not sub-processors of Advanto. The Customer or its users choose them and connect them to the Platform, and Advanto passes personal data to them on the Customer’s instruction:
- Google Calendar and Microsoft Outlook / Microsoft 365 calendars connected by a user (interview scheduling; see section 13 of the DPA for Google APIs),
- the Customer’s applicant tracking system connected through the ATS synchronisation,
- the Customer’s payroll and HR system (for example Asseco AVAplace / HELIOS),
- systems that the Customer connects through webhooks or the public API of the Platform.
4. Transfers outside the European Economic Area
4.1 Where the List states a location of processing outside the European Economic Area, or where the sub-processor belongs to a group established outside the European Union, the transfer of personal data is covered by appropriate safeguards under Article 45 or 46 of the GDPR in accordance with section 1.2.5 of the DPA, in particular an adequacy decision of the European Commission (EU-US Data Privacy Framework, “DPF”) or the standard contractual clauses (“SCC”). The Customer may request a copy of the safeguards at gdpr@advanto.cz.
5. Changes to the List
5.1 Advanto informs the Customer by e-mail before it adds or removes a sub-processor, and the Customer may object within 14 days in accordance with section 7.3 of the DPA. The current version of the List is always available at www.advanto.cz/privacy/people/sub-processors. Questions about sub-processors can be sent to gdpr@advanto.cz.
Last updated: 13 November 2026