SUBPROCESSOR SCHEDULE

GHL Nexus
Last Updated: September 2025

This Subprocessor Schedule forms part of the Terms of Service and Privacy Policy of GHL Nexus operated by Crown Agency Group LLC (β€œCompany,” β€œwe,” β€œus,” or β€œour”).

This Schedule applies where we process personal data on behalf of customers acting as data controllers under applicable data protection laws, including GDPR and UK GDPR.

1. PURPOSE

This Schedule identifies third-party subprocessors that may process personal data in connection with providing the Platform.

We use subprocessors solely for legitimate business purposes including infrastructure hosting, AI processing, logging, analytics, and payment processing.

2. CORE INFRASTRUCTURE SUBPROCESSORS

Subprocessor Category Purpose of Processing Data Types Potentially Processed Hosting Location
Cloud Infrastructure Provider Hosting application servers and storage Account data, configuration data, logs United States
Vector Database Provider Embedding storage and semantic retrieval Documentation embeddings, metadata United States
AI Model Provider(s) AI inference and generation User prompts, contextual retrieval data United States
Payment Processor Billing and subscription processing Billing name, email, payment details United States
Email Delivery Provider Transactional communications Email address, system messages United States
Logging & Monitoring Provider Security, diagnostics, audit trails IP address, event logs, execution logs United States

3. PROCESSING CHARACTERISTICS

3.1 Subprocessors are engaged for the following purposes:

  • Cloud hosting and secure storage

  • AI inference and model execution

  • Vector indexing and retrieval

  • Payment processing

  • Security logging and monitoring

  • Transactional email delivery

3.2 Subprocessors are contractually required to:

  • Implement appropriate technical and organizational safeguards

  • Process data only on documented instructions

  • Maintain confidentiality obligations

  • Assist with data subject rights where applicable

4. INTERNATIONAL TRANSFERS

4.1 Data is hosted in the United States.

4.2 For transfers from the EU or UK, we rely on:

  • Standard Contractual Clauses (SCCs), where required

  • Supplementary safeguards where applicable

5. SUBPROCESSOR CHANGES

5.1 We may update this Schedule from time to time.

5.2 Material changes will be reflected in the updated Schedule and may be communicated via Platform notice.

5.3 Continued use of the Platform constitutes acceptance of updated subprocessors.

6. CUSTOMER OBLIGATIONS

Customers are responsible for:

  • Ensuring lawful basis for data processing

  • Informing their end users of subprocessors where required

  • Executing a Data Processing Addendum if required by law