Sub-processors

1.About this list

1.1 A sub-processor is a third party engaged by BiopharmaWatch LLC to process Customer Data on a Customer's behalf in providing SDRclose. Customer Data has the meaning given in the Data Processing Addendum: the prospect records, research notes, drafts, sent messages, replies and engagement records a Customer brings into or generates within the Service.

1.2 This page is the canonical list of sub-processor categories. It is incorporated by reference into section 7 and Annex 3 of the Data Processing Addendum and is referred to in section 7 of the Privacy Policy.

1.3 The mailbox providers a Customer connects (Gmail or Google Workspace, Outlook or Microsoft 365, Zoho, or another IMAP/SMTP provider) send and receive the Customer's messages under the Customer's own agreement with that provider. They act on the Customer's instructions and are not sub-processors of SDRclose. The same applies to the calendar account a Customer connects and to the recipients of the Customer's messages.

1.4 Providers are described here by category, purpose and the data they handle. The named list is provided as described in section 5.

2.How we select and contract with sub-processors

2.1 Due diligence. Before engaging a sub-processor we review its security practices, its privacy and data-processing terms, and its suitability for the task. We engage a provider only where the task cannot reasonably be performed within SDRclose and the provider offers protections appropriate to the data involved.

2.2 Written contracts. Each sub-processor is bound by a written contract that restricts processing to the documented purpose, prohibits use of Customer Data for the provider's own purposes, imposes confidentiality obligations on the provider and its personnel, requires appropriate technical and organizational measures, and provides for deletion or return of data when the engagement ends.

2.3 Data minimization. Each provider receives only the data its task requires.

2.4 International transfers. Some providers operate outside the country in which a Customer is established. Those transfers are covered by the safeguards in the Data Processing Addendum, section 13, including standard contractual clauses and the UK Addendum where they apply.

2.5 Responsibility. We remain responsible to the Customer for each sub-processor's performance of its data-protection obligations.

3.Current sub-processors by category

3.1 The table lists every category of sub-processor currently engaged, its purpose, the data it processes and the point at which it is engaged. Each row is one category; the named list identifies the provider within it.

4.Artificial intelligence and research providers

4.1 No training. Language-model and research providers are engaged only on terms under which submitted data is not used to train, retrain or improve their models. SDRclose trains no models on customer or prospect data.

4.2 Minimum context. Each task receives only the context it requires: the prospect fields and research notes needed to write a message, the Customer's writing settings, or the text of the reply being classified. A Customer's full workspace, mailbox credentials and unrelated records are never sent.

4.3 Customer control. These providers are engaged only when a Customer uses the feature that calls them, at the Customer's request or under settings the Customer has switched on for a sequence. Hand-written locked templates and human-typed replies are sent verbatim and are not submitted to a language-model provider. Section 6 of the Privacy Policy describes automated processing in the Service more fully.

5.Obtaining the named list

5.1 On request. A current list identifying each sub-processor by name, with the processing it performs, is available without charge to Customers and to prospective Customers conducting a vendor assessment. Request it through the contact form, identifying the account or organization on whose behalf the request is made.

5.2 As a contractual schedule. Customers may receive the same list as Annex 3 to the Data Processing Addendum, so that the named providers form part of the contractual record.

5.3 Security questionnaires. Where a vendor assessment also requires a security questionnaire, we respond on request as described on the Security page.

6.Notice of changes and right to object

6.1 Notice. We will give Customers at least 30 days' notice by email to the account address before a new sub-processor processes Customer Data. This page is updated at the same time and the change is recorded in section 7.

6.2 Right to object. A Customer may object on reasonable data-protection grounds within that period, through the contact form on our website. We will consider the objection in good faith and whether the concern can be resolved, for example by a configuration change.

6.3 Remedy. If the objection is not resolved, the Customer may terminate the affected part of the Service before the change takes effect and receive a pro rata refund of prepaid fees for that part. The full process is set out in section 7 of the Data Processing Addendum.

6.4 Removals and replacements. Removing a provider, or replacing one within an existing category with another performing the same processing under equivalent safeguards, is recorded in section 7 and notified in the same way.

7.Change log

7.1 Each change to this list is recorded below with the date it took effect.

• 5 September 2026: Initial publication of this list.

8.How to contact us

8.1 Requests for the named list, objections to a proposed sub-processor, requests for a Data Processing Addendum and questions about this page should be sent through the contact form on our website. Please identify the account concerned so that we can verify the request.

8.2 BiopharmaWatch LLC operates SDRclose and is the party responsible for this page. Support is provided by the SDRclose team by written message during business hours, in English.