LoyJoy

DPA Annex 2: Sub-Processors of LoyJoy GmbH GDPR

•
Change history (6 entries)
  • 25/06/2026 AI inference note restructured for readability. Microsoft Azure added as an optional LLM sub-processor (in addition to its mandatory Phone Agent role). Added 'Not active while the default path is in use' note to all optional LLM vendors (Azure, OpenAI, Mistral, Scaleway, Nebius).
  • 22/06/2026 Scaleway and Nebius reclassified from mandatory to optional sub-processors. Default AI inference (Gemma 4 chat LLM, embeddings, summarizer, AI quality analysis, sentiment analysis, topic modeling, and Intelligent Insights for analytics) now runs on LoyJoy-owned hardware in Münster, with no external AI sub-processor.
  • 18/05/2026 Scaleway section reworded for clarity.
  • 06/05/2026 easybell GmbH added as mandatory sub-processor for telephony functions of the LoyJoy Phone Agent.
  • 05/05/2026 Microsoft Azure reclassified from optional to mandatory sub-processor and extended to cover speech-to-speech and telephony functions of the Phone Agent.
  • 01/03/2026 Initial publication of the sub-processor list.

LoyJoy GmbH uses the following sub processors for processing personal data. Annex 2 to the DPA.

Note on AI inference

LoyJoy runs its AI inference on its own hardware in Münster by default. Running there are:

  • Gemma 4 as the chat LLM
  • Embeddings
  • The summarizer for conversation summaries
  • The AI quality analysis
  • Sentiment analysis, topic modeling, and Intelligent Insights for analytics

No external AI sub-processor is engaged for this default inference. External vendors listed under “Optional sub-processors” only become active if an Enterprise tenant explicitly selects additional models such as GPT or Claude.

Mandatory sub processors

1) Google Cloud EMEA

Google Cloud EMEA Ltd, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland

Tasks: The LoyJoy infrastructure is operated in the Google Cloud by Google Ireland, and the server locations are within the EU. If personal data is processed, it is encrypted as far as possible.

2) BunnyWay d.o.o. (Bunny.net)

BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia (EU)

Tasks: Content Delivery Network (CDN) for fast delivery of the LoyJoy web application.

3) G-Core Labs S.A.

G-Core Labs S.A., 2 Rue Edmond Reuter, 5326 Contern, Luxembourg

Tasks: Content Delivery Network (CDN) for DDoS mitigation as a backup solution for Bunny.net to maximize availability and security.

4) Amazon Web Services EMEA

Amazon Web Services EMEA SARL, 28 Avenue John F. Kennedy, L-1855, Luxembourg

Tasks: Email sending from LoyJoy is done via AWS. The server location is EU. For sending emails to end customers, a different SMTP can be configured in LoyJoy, effectively preventing the usage of AWS.

Mandatory sub processors for Phone Agent use

The following sub-processors are only active when the LoyJoy Phone Agent is used and are only engaged for data processing in that case.

5) Microsoft Azure

Microsoft Ireland Operations, Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland

Tasks: Provision of AI-based language models for answering customer questions, and provision of a speech-to-speech model for telephony dialogues. This includes, depending on configuration, processing of voice inputs, generation of voice outputs, processing of transcripts, provision of the audio stream, receiving and processing telephony calls, handling telephony control commands (e.g. call forwarding), and provisioning of phone numbers.

Server location: Text-based Azure OpenAI processing takes place in EU regions. Speech-to-speech functions of the Phone Agent are currently processed via global Azure services, as this feature is not yet available as an exclusive EU region.

Description of security measures for transfers to third countries (Art. 44 GDPR): Transport encryption with TLS, EU Standard Contractual Clauses, certification under the EU–U.S. Data Privacy Framework, and the technical and organisational measures provided by Microsoft.

We will provide you with the standard contractual clauses upon request.

6) easybell GmbH

easybell GmbH, Brückenstraße 5a, 10179 Berlin, Germany

Tasks: Provisioning and provision of phone numbers, receiving and processing telephony calls, provision of the audio stream, handling telephony control commands (e.g. call forwarding), and technical provision of telephony functions for the LoyJoy Phone Agent.

Server location: Germany and the European Union, to the extent provided by easybell for the respective service.

Description of security measures for transfers to third countries (Art. 44 GDPR): Where a transfer to third countries cannot be excluded, it is carried out on the basis of appropriate safeguards, in particular EU Standard Contractual Clauses, transport encryption and further technical and organisational measures.

Optional sub processors

Upon request and instruction of the customer, the following sub processors may be used.

7) Microsoft Azure (LLMs)

Microsoft Ireland Operations, Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland

Tasks: Optional provision of AI-based language models (Azure OpenAI) for answering customer questions, only if explicitly selected by the tenant. Not active while the default path (Gemma 4 on LoyJoy hardware in Münster) is in use. This usage is to be distinguished from the mandatory Azure usage for the Phone Agent (see above), which additionally covers speech-to-speech and telephony functions.

Server location: Chat LLMs are sourced exclusively from EU Azure regions.

Description of security measures for transfers to third countries (Art. 44 GDPR): Transport encryption with TLS, EU Standard Contractual Clauses, certification under the EU–U.S. Data Privacy Framework, and the technical and organisational measures provided by Microsoft.

We will provide you with the standard contractual clauses upon request.

8) OpenAI (USA)

OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA

Tasks: Provide an AI-based Language Model to answer customer questions. Not active while the default path (Gemma 4 on LoyJoy hardware in Münster) is in use. The server location is the US.

Description of security measures concerning transfers to third countries (Art.44): Transport encryption with TLS, EU standard contractual clauses.

We will provide you with the standard contractual clauses upon request.

9) Mistral

Mistral AI, 15 Rue des Halles, 75001 Paris, France

Tasks: Provision of an AI-based language model for answering customer questions. Not active while the default path (Gemma 4 on LoyJoy hardware in Münster) is in use. The server is located in the EU.

10) Scaleway

Scaleway SAS, 8 rue de la Ville l’Evêque, 75008 Paris, France

Tasks: Optional provision of AI-based language models for answering customer questions, only if explicitly selected by the tenant. Server location within the EU. Where personal data is processed, it is encrypted as far as possible. Not active while the default path (Gemma 4 on LoyJoy hardware in Münster) is in use.

11) Nebius Group N.V.

Nebius Group N.V., Schiphol Boulevard 165, 1118 BG Schiphol, Netherlands

Tasks: Optional provision of AI-based language models for answering customer questions, only if explicitly selected by the tenant. Server location EU. Not active while the default path (Gemma 4 on LoyJoy hardware in Münster) is in use.