List of Sub-Processors

Sub-Processor	Description of data processing activity	Categories of personal data	Location of data processing activity. If data is transferred to a third country, the legal basis for the transfer
Amby Sweden AB having its registered office at Drottninggatan 33, 111 51 Stockholm, Sweden, registered under the organization number (organisationsnummer) 559349-1862	Conducting recruitment activities	Personal details such as name, personal identifiers, email address, home address, telephone number, and date of birth. Records of communications created, stored, or transmitted for professional or job-related purposes, as well as videos in case the recruitment process involves an interview using the Video Interview feature. Personal information received from the applicant/candidate such as qualifications, experience, information relating to employment history, current job title, desired salary, salary, earnings and benefits, transcript of grades, references, and resume. Information received from third parties such as background check information, and assessment results. Demographic details such as age, tenure, gender, seniority, work status, and place of work. In some cases and solely for security purposes namely authorization and input control, technical information such as public IP address, time and date of access, browser activities, browser settings, and Lon-In ID data.	Sweden. The data is not transferred outside of the EEA.
Amby Poland sp. z o.o. having its registered office at sw. Filipa 23/3, 31-150 Krakow, registered under the organization number 0001001545	Conducting recruitment activities	Personal details such as name, personal identifiers, email address, home address, telephone number, and date of birth. Records of communications created, stored, or transmitted for professional or job-related purposes, as well as videos in case the recruitment process involves an interview using the Video Interview feature. Personal information received from the applicant/candidate such as qualifications, experience, information relating to employment history, current job title, desired salary, salary, earnings and benefits, transcript of grades, references, and resume. Information received from third parties such as background check information, and assessment results. Demographic details such as age, tenure, gender, seniority, work status, and place of work. In some cases and solely for security purposes namely authorization and input control, technical information such as public IP address, time and date of access, browser activities, browser settings, and Lon-In ID data.	Poland. The data is not transferred outside of the EEA.
Teamtailor AB, located at Östgötagatan 16, 11621 Stockholm, Sweden, and registered with the Swedish Companies Registration Office under company number 556936-6668, or any other Applicant Tracking System (ATS) chosen by Client	Applicant Tracking System - a software solution that helps source talent assess potential, track interview processes, evaluate performance, make offers, and hire	Personal details such as name, personal identifiers, email address, home address, telephone number, and date of birth. Records of communications created, stored, or transmitted for professional or job-related purposes, as well as videos in case the recruitment process involves an interview using the Video Interview feature. Personal information received from the applicant/candidate such as qualifications, experience, information relating to employment history, current job title, desired salary, salary, earnings and benefits, transcript of grades, references, and resume. Demographic details such as age, tenure, gender, seniority, work status, and place of work. In some cases and solely for security purposes namely authorization and input control, technical information such as public IP address, time and date of access, browser activities, browser settings, and Lon-In ID data.	The data is not transferred outside of the EEA.
LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, company registration #477441	Amby will use LinkedIn's services to search for potential candidates during recruitment processes.	Personal details such as name, personal identifiers, email address, home address, telephone number, and date of birth. Records of communications created, stored, or transmitted for professional or job-related purposes, as well as videos in case the recruitment process involves an interview using the Video Interview feature. Personal information received from the applicant/candidate such as qualifications, experience, information relating to employment history, current job title, desired salary, salary, earnings and benefits, transcript of grades, references, and resume. Demographic details such as age, tenure, gender, seniority, work status, and place of work. In some cases and solely for security purposes namely authorization and input control, technical information such as public IP address, time and date of access, browser activities, browser settings, and Lon-In ID data.	LinkedIn's services require data to flow from the European Union (EU), the European Economic Area (EEA), United Kingdom (UK) and Switzerland to the United States (U.S.) and back. The subprocessor is required to implement lawful SSCs or rely on adequacy decisions.
Semac AS, org. Nr. 994 000 489, with its registered address at Postboks 34, Vollebekk, 0516 Oslo, Norway	Amby will use the services of Semac only if Client accepts this service provider. The services of this service provider are not necessary for Amby to provide services, but they can facilitate recruitment processes. Semac allows for provision of background checks. A background check is to verify and search for information that may have an impact on the recruitment process.	Name, date of birth, social security number, telephone number, email address, and information in cases that concern matters related to life and health, criminal offenses, actions, values, competence, quality, environment, or reputation.	In case of background checks, the data is not transferred outside of the EEA. If the data is transferred outside of the EEA, the subprocessor is required to implement
Aon Assessment (Norway) AS, corporate registration number 986 606 947, with its registered address at Stortingsgata 6, 0161 Oslo, Norway	Amby will use Aon's services only with Client’s approval and at its express direction. Without Client’s request, Amby will not send personal data to Aon. The services of this service provider are not necessary for Amby to provide services, but they can facilitate recruitment processes. Aon allows for provision of online candidate assessment and 360 feedback solutions.	Basic personal details (name, surname, email, employee ID if provided), demographic details (age, tenure, gender), employment and education related data (job position, seniority, work status, place of work if provided), public IP address (for support purposes), video where relevant to services.	Aon assures that transfer of personal data by Aon to Aon entities, service providers or business partners is covered by agreements based on the EU Commission's standard contractual clauses, which contractually oblige each party to ensure that personal information receives an adequate and consistent level of protection wherever it resides within Aon.
Metaview Global Limited, a company registered in England and Wales with company registration number 11313397, and whose registered office is at 21-33 Great Eastern St, London EC2A 3EJ.	Amby will use the services of Metaview only if the Client accepts this service provider and decides to use its services during the recruitment process. The services of this service provider are not necessary for Amby to provide services, but they can facilitate recruitment processes. Metaview allows for creation of AI generated interview notes.	Names of employees and job candidates, email addresses of the job candidates and employees, video and voice of employees and job candidates.	As a general rule, data is not transferred outside of the EEA, however, the sub-processor might use some of its service providers located in the US. In such a case, the subprocessor is required to implement lawful SSCs or rely on adequacy decision.