FLIPFLOW SUBPROCESSOR LIST

Effective Date: 1 May 2026

Last Updated: 1 May 2026

Review Frequency: At least annually

This Subprocessor List identifies third-party service providers that may process Customer Personal Data on behalf of Flipflow Data Analytics, S.L. (“Flipflow”) in connection with the provision of its Services.

This document should be read together with the:

• Master Subscription Agreement (MSA)
• Data Processing Addendum (DPA)
• Privacy Policy
• Security Addendum

available at:

https://www.flipflow.io/en/legal

1. PURPOSE

Flipflow may engage carefully selected third-party service providers (“Subprocessors”) to support the delivery, operation, security and improvement of its Services.

Flipflow evaluates subprocessors based on commercially reasonable criteria including:

• Security practices;
• Privacy controls;
• Regulatory compliance;
• Reliability and operational maturity;
• Contractual commitments;
• Data protection capabilities.

Flipflow remains responsible for its subprocessors to the extent required by applicable Data Protection Laws.

2. CURRENT SUBPROCESSORS

The table below reflects the subprocessors engaged as at the Last Updated date. The transfer mechanism column indicates the safeguard relied upon for processing outside the EEA/UK/Switzerland, where applicable.

Note: The transfer mechanisms above reflect verification carried out against the U.S. Department of Commerce Data Privacy Framework list (dataprivacyframework.gov) as at the Last Updated date. For providers that hold an active EU-U.S. DPF certification, the adequacy decision is relied upon as the primary transfer mechanism, with the Standard Contractual Clauses maintained as a fallback under the relevant Data Processing Agreement. For Anthropic, PBC, Flipflow relies on the Standard Contractual Clauses. Flipflow reviews the certification status of its subprocessors periodically and updates this table accordingly.

3. AI-RELATED SUBPROCESSORS

Certain subprocessors may only process Customer Personal Data when the corresponding functionality is enabled by Customer.

This may include, without limitation:

• Anthropic;
• Google Vertex AI;
• Gemini;
• future AI service providers that may be integrated into the Services.

Where AI Features are enabled, Customer Personal Data is processed solely for the purpose of providing the requested functionality.

Customer Personal Data is not used to train any artificial intelligence or machine learning models, whether publicly available or internal.

4. INTERNATIONAL DATA TRANSFERS

Certain subprocessors may process Personal Data outside the European Economic Area, the United Kingdom or Switzerland.

Where such transfers occur, Flipflow implements appropriate safeguards in accordance with applicable Data Protection Laws, as indicated in the transfer mechanism column of Section 2, including where appropriate:

• Adequacy Decisions, including the EU-U.S. Data Privacy Framework where the relevant entity holds a valid, active certification covering the data;
• Standard Contractual Clauses (SCCs), together with the UK Addendum and Swiss adaptations where applicable;
• Other lawful transfer mechanisms.

Additional information regarding international transfers, including the specific mechanism applicable to a given subprocessor, may be requested by contacting:

privacy@flipflow.io

5. APPOINTMENT OF NEW SUBPROCESSORS AND NOTIFICATION MECHANISM

Flipflow may add, replace or remove subprocessors from time to time as its infrastructure, products and operational requirements evolve.

Flipflow shall notify Customers of any intended addition or replacement of a subprocessor at least thirty (30) days before the new subprocessor begins processing Customer Personal Data.

Notification is provided through the following mechanism:

• publication of the updated Subprocessor List at the URL set out in Section 7; and
• email notification to Customers who have subscribed to subprocessor update notifications.

Customers may subscribe to subprocessor update notifications through the mechanism available at the URL set out in Section 7, or by request to privacy@flipflow.io.

Customers may object to newly appointed subprocessors on reasonable data protection grounds in accordance with the Data Processing Addendum available at:

https://www.flipflow.io/en/dpa

If the parties are unable to reasonably resolve a valid objection, Customer may terminate the affected Services and receive a refund of prepaid fees for the unused portion of the then-current Subscription Term for the terminated Services, in accordance with the DPA and Section 23.6 of the MSA.

6. SECURITY REQUIREMENTS

Flipflow requires subprocessors to maintain security measures appropriate to the services they provide.

Such measures may include:

• Access controls;
• Encryption measures;
• Incident response procedures;
• Personnel confidentiality obligations;
• Security monitoring practices;
• Data protection safeguards.

Flipflow performs commercially reasonable diligence when selecting subprocessors and periodically reviews subprocessor relationships.

7. CHANGES TO THIS SUBPROCESSOR LIST

Flipflow may update this Subprocessor List periodically to reflect changes in:

• Infrastructure providers;
• Service providers;
• AI providers;
• Analytics providers;
• Operational requirements.

The current version shall always be available at:

https://www.flipflow.io/en/subprocessors

8. CONTACT

For questions regarding this Subprocessor List or Flipflow’s data processing practices, please contact:

Privacy Team

privacy@flipflow.io

Security Team

security@flipflow.io

Flipflow Data Analytics, S.L.

Paseo de la Chopera 142, Bajo B

28100 Alcobendas, Madrid, Spain

VAT Number: B10950343