Contact

Sub-processors of Nubos

Last updated: 29 October 2026. Nederlandse versie

For most of our products we process personal data on behalf of our customers, such as data of candidates and applicants. To do so we engage a number of parties that carry out part of the work for us: hosting, email, AI models or messaging services. These are our sub-processors. With each of them we have made data processing arrangements that offer at least as much protection as our own Data Processing Terms.

For each sub-processor this page states what it does for us, where the data is processed and which safeguard applies when that happens outside the European Economic Area (EEA). A sub-processor only processes data of the products listed with it. If you do not use a product, that party does not see any of your data.

We announce a new or replacement sub-processor at least 30 days in advance, on this page and by email to our customers. Until the effective date you can object, as described in article 8 of the Data Processing Terms. Questions can be sent to privacy@nubos.nl.

About the safeguards: EU/EEA means the data stays within the EEA. Adequacy decision means the European Commission has found that the country offers an equivalent level of protection. DPF is the EU-US Data Privacy Framework, the adequacy decision for US organisations that have joined it. SCC are the standard contractual clauses of the European Commission.

For all products

  • Hetzner Online GmbH: hosting of the applications, databases and file storage. Location: Germany, one management server in Finland. Safeguard: EU/EEA. Products: all.
  • Cloudflare, Inc.: storage of encrypted backups. Location: US. Safeguard: SCC and/or DPF. Products: all.
  • Amazon Web Services EMEA SARL: sending email. Location: Ireland (eu-west-1), parent company in the US. Safeguard: EU/EEA, SCC and/or DPF for access from the US. Products: all.
  • Rollbar, Inc.: error monitoring of the software. Location: US. Safeguard: SCC and/or DPF. Products: all.

Per product

  • OpenAI Ireland Limited (parent company OpenAI in the US): AI language model for conversations with candidates and processing their answers, analysing CVs and vacancies, and reading documents. For Recruit Website and Recruit Social only for site and vacancy texts, without candidate data. Location: US. Safeguard: SCC and/or DPF. Products: Recruit Enrich (also through Recruit Connect), Recruit Matching, Wet gelijke beloning, Recruit Website, Recruit Social.
  • Mistral AI SAS: AI language model, when the customer chooses a European provider. Location: France. Safeguard: EU/EEA. Products: Recruit Enrich, Recruit Social (vacancy texts only).
  • Google LLC: AI language model (Gemini), only when the customer switches that option on. Location: US. Safeguard: SCC and/or DPF. Products: Recruit Enrich.
  • Twilio Ireland Limited (parent company Twilio Inc. in the US): sending and receiving text and WhatsApp messages and phone calls. Location: worldwide, including the US. Safeguard: SCC and/or DPF. Products: Recruit Enrich.
  • Meta Platforms Ireland Limited: WhatsApp messages to candidates. Location: Ireland and the US. Safeguard: EU/EEA, SCC and/or DPF for the US. Products: Recruit Enrich (also through Recruit Connect).
  • Eleven Labs Inc.: phone calls with an AI voice and transcribing them, without an audio recording. Location: US. Safeguard: SCC and/or DPF. Products: Recruit Enrich.
  • Apify Technologies s.r.o.: retrieving LinkedIn profile data for an email address. Location: Czech Republic. Safeguard: EU/EEA. Products: Recruit Enrich.
  • Google LLC: reCAPTCHA, protecting forms against automated submissions. Location: US. Safeguard: SCC and/or DPF. Products: Recruit Website, Recruit Connect.
  • OpenStreetMap Foundation: converting a place name into coordinates, only the place name and no other data. Location: United Kingdom and EU. Safeguard: adequacy decision (United Kingdom). Products: Recruit Matching.

Supporting services

We use these services for our own work. Personal data of customers ends up in them when a customer sends it to us, for example with a support question or a report about a candidate.

  • Google Ireland Limited: Google Workspace for email, documents and storage. Location: Ireland, parent company in the US. Safeguard: EU/EEA, SCC and/or DPF for the US. Products: all (support).
  • Anthropic, PBC: AI assistant for customer communication and support. Location: US. Safeguard: SCC and/or DPF. Products: all (support).

What is not listed here

  • Parties that you as a customer connect yourself, such as your ATS, job boards, your social media advertising accounts or your website analytics account. They receive or supply data because you set it up that way, and are not sub-processors of Nubos.
  • Services that receive no personal data of your candidates, such as a source of collective labour agreement pay scales, a stock photo library for advertisements or a service that only translates ATS statuses.
  • Parties we use for our own administration, such as our accounting software. Nubos is itself responsible for that, see our privacy policy.

This page is a translation. In case of a conflict, the Dutch version prevails.