Sub-processors
Which suppliers process personal data on our behalf, what they do and where the processing takes place. The page exists so that you do not have to ask.
Two roles, two lists
P&M has different roles depending on whose data is involved, and that determines who is responsible for what.
In surveys, the client is the controller and P&M the processor. The suppliers below are then sub-processors. Which ones we engage is governed by the data processing agreement with each client, and we may not engage a new sub-processor without first obtaining the client's written approval.
For this website, P&M is the controller. The second list applies there.
For surveys
All of them process the data within the EU or the EEA, and we have a data processing agreement with each one. No transfer to a third country takes place.
| Supplier | Purpose | Processed in |
|---|---|---|
| Forsta Worldwide AB Sankt Persgatan 99, 602 32 Norrköping, Sweden |
Reporting and visualisation of survey data. Automatic summaries of open-ended responses are generated in Microsoft Azure OpenAI within the platform – neither the responses nor the summaries are used to improve AI models or any other product. | The Netherlands |
| Alchemer 168 Centennial Pkwy, Unit 250, Louisville, CO 80027, USA EU representative: DP-Dock GmbH, Ballindamm 39, 20095 Hamburg, Germany |
Data collection | Germany |
| Brevo 106 Bd Haussmann, 75008 Paris, France |
Sending email with delivery tracking | France |
| Microsoft Corporation One Microsoft Way, Redmond, WA 98052, USA |
Storage and email in Microsoft 365 – OneDrive, Outlook and related services | Sweden |
For this website
Here P&M is the controller. This covers what you provide when you book a meeting or fill in a form, and visitor statistics if you have consented to them.
| Supplier | Purpose | Processed in |
|---|---|---|
| HubSpot | CRM, meeting bookings and contact forms | EU |
| Visitor statistics – loaded only after consent | EU and USA |
What the agreement commits us to
Beyond what the EU General Data Protection Regulation requires, our data processing agreement contains a few commitments worth knowing about:
- Incidents are reported within 24 hours of us becoming aware of them, with a description of their nature, the categories of data affected, the preliminary scope and the measures taken. The Regulation gives the controller 72 hours; we keep a shorter deadline so that you have time for your own.
- New sub-processors require your written approval in advance – not merely a notification.
- No processing outside the EU or the EEA without your written permission.
- You have a right of inspection and may verify that the commitments are met, yourselves or through an independent third party.
If you need more
For procurement and security reviews we are glad to provide material beyond what is stated here – the data processing agreement, a description of our security procedures and details of individual suppliers. Write to info@pochm.se.
How we work with anonymity thresholds, retention periods and the rights of data subjects is described in our privacy notice.
Changes
If we replace a sub-processor or add a new one, this page is updated and the date at the top changes. The page is an overview, not a notification: clients with ongoing assignments approve the change in writing in advance under the data processing agreement, and that happens directly with you.