Sub-processor Notice
Last updated: 12 May 2026 · LOCAVERDI B.V.
1. Purpose
This notice lists the third-party sub-processors that LOCAVERDI B.V. engages to provide the Readmodel® service, in accordance with Art. 32 of the NLdigital Terms 2025 and GDPR Art. 28. Users have the right to object to changes in sub-processors as specified in Art. 32.3 of the NLdigital Terms.
2. Current sub-processors
| Sub-processor | Purpose | Location | Data processed |
|---|---|---|---|
| Mollie B.V. mollie.com |
Payment processing for subscription billing | Netherlands (EU) | Billing name, email, payment method details, transaction amounts. Processed under Mollie's PCI DSS-compliant infrastructure. |
| Jortt B.V. jortt.nl |
Invoice generation for accounting | Netherlands (EU) | Company name, billing address, VAT number, invoice line items, amounts. |
| Keila (Pentacent OÜ) keila.io |
Newsletter delivery | Estonia (EU) | Email address of voluntary newsletter subscribers. Open-source platform, EU-hosted. Subscribers can unsubscribe at any time. |
| CrowdSec SAS crowdsec.net |
Infrastructure security (threat detection and prevention) | France (EU) | IP addresses of incoming requests, attack type classification. Malicious IPs are shared with the CrowdSec community blocklist to protect other users. No other personal data is transmitted. |
| Additional sub-processors (hosting, email) will be listed here once production infrastructure is finalised. | |||
3. AI processing — self-hosted, no AI sub-processor
The AI features in Readmodel® — the AI-generated report and the summarisation of uploaded documents (DPAs, privacy policies) and policy/terms URLs — run on a language model hosted on infrastructure operated by LOCAVERDI B.V., the operator of the Readmodel® service. All AI processing happens on that infrastructure:
- Project data is not transmitted to any third-party AI provider. There is no AI vendor in the sub-processor list in Section 2 and no AI sub-processor for this feature.
- Project data is not used to train any model. The model is run for inference only; inputs are not retained beyond the duration of the request that produced the report.
- The same applies to documents you upload to a service and to the text of any terms / privacy policy URLs you record: their structured summaries are generated by the same self-hosted model and cached against the document or URL for reuse on later report runs.
- Because the data never leaves infrastructure operated by LOCAVERDI B.V., no anonymisation step is applied to it.
4. Consultancy engagements
Where Readmodel® delivers a paid consultancy engagement (GDPR Quickstart, AI Act Readiness, Sovereignty & Transfer Audit, or related work), the Client's personal data is processed within the same Readmodel® workspace and therefore flows through the same sub-processor stack listed in Section 2 above.
Two consultancy-specific points to note:
- Role. For consultancy engagements LOCAVERDI B.V. acts as processor for the Client (controller). The full Art. 28 terms are set out in the Consultancy Processor DPA; this notice is the disclosure of sub-processors required by that DPA.
- AI processing of uploaded documents. When documents provided by the Client are summarised (e.g. a vendor DPA, a privacy policy or a sub-processor list), the document text is processed by the same self-hosted model described in Section 3 — not transmitted to any third-party AI provider, not used for training. Raw production datasets must not be uploaded to the engagement workspace; the engagement is documentation work and the Client warrants it will not transmit such data.
Sub-processor changes for consultancy engagements follow the same notification process as for SaaS subscribers (30 days' notice; objection right). Changes are announced on this page.
5. Changes to this notice
LOCAVERDI B.V. will update this notice when sub-processors are added, removed, or changed. In accordance with Art. 32.3 of the NLdigital Terms, clients will be informed of changes and have the right to object.
6. Contact
Questions about sub-processors or data processing? Contact us.