ENEnglish
SKSlovensky
CZČesky
People Flow Logo

List of Subprocessors

Last Updated: 01.09.2025

Version: 1.0

Introduction

This document lists all subprocessors engaged by SAMETA s.r.o. (trading as "People Flow") to process personal data on behalf of our customers. We maintain this list in accordance with our obligations under the General Data Protection Regulation (GDPR) and our Data Processing Agreement.

As described in our Privacy Policy and Terms of Service, we engage carefully selected third-party service providers to help us deliver and improve the People Flow platform.

Notification of Changes

We will provide at least 10 days' prior written notice before engaging any new subprocessor. Customers have the right to object to the use of a new subprocessor within this notice period by contacting us at [email protected].

Current Subprocessors

The following table lists all subprocessors currently engaged by People Flow as of 01.09.2025:

1

Firebase (Google)

Purpose:User authentication (Firebase Auth)
Type of Data Processed:
  • Email addresses, identifiers, login credentials
2

AWS (S3, Parameter Store, Secrets Manager, IAM)

Purpose:File storage, secure configuration management, and infrastructure access control
Type of Data Processed:
  • Documents containing personal data (e.g. PDFs, images)
  • Configuration data, credentials (may include tokens linked to user actions)
Note: While some components do not directly process end-user data, they are part of the infrastructure stack and are therefore considered subprocessors.
3

Google API (Gmail & Calendar)

Purpose:Gmail API: Sending and receiving emails with candidates. Google Calendar API: Scheduling interviews with candidates during the recruitment process
Type of Data Processed:
  • Email addresses, communication content, scheduled events
4

Sentry

Purpose:Error monitoring and logging
Type of Data Processed:
  • May potentially include metadata on user activity, user IDs for error tracing
5

OpenAI API

Purpose:Language model embeddings generation and structured data extraction
Type of Data Processed:
  • Raw or tokenized text (including job descriptions or pseudonymized candidate CVs). Returns JSON with embeddings or structured data
6

MistralAI API

Purpose:Language model embeddings generation
Type of Data Processed:
  • Raw or tokenized text (job descriptions or candidate data). Returns embeddings vector
7

Vercel

Purpose:Frontend deployment
Type of Data Processed:
  • Potentially static content of the application, which may retrieve data via REST API

Data Transfer Safeguards

Where subprocessors are located outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place to protect your personal data in accordance with GDPR requirements. These safeguards may include:

  • Standard Contractual Clauses (SCCs): EU-approved contractual terms that ensure adequate data protection
  • Adequacy Decisions: Countries recognized by the European Commission as providing adequate data protection
  • Additional Technical Measures: Encryption, pseudonymization, and access controls

For more information about our data transfer mechanisms, please see our Privacy Policy or contact us at [email protected].

Your Rights

As a customer of People Flow, you have the right to:

  • Receive notice of any new subprocessors we intend to engage
  • Object to the use of a new subprocessor within the notice period
  • Request a copy of the Standard Contractual Clauses we have in place with subprocessors
  • Receive information about the security measures implemented by our subprocessors

To exercise any of these rights, please contact us at [email protected].

Contact Information

If you have any questions about our subprocessors or data processing practices, please contact us at:

SAMETA s.r.o.
Čulenova 7936/5
811 09 Bratislava
Slovak Republic
Email: [email protected]

© 2026 .