Sub-processors
Last updated: July 13, 2026 · Version 3
1. About This List
Lataamo's event application is operated by Lataamo Group Oy (Business ID: 1652310-5), Espoo, Finland. When an event organizer engages us to run their event, the organizer is the data controller and Lataamo Group Oy acts as the data processor.
To provide the platform, we engage the third-party service providers ("sub-processors") listed below. Every sub-processor is bound by a data processing agreement that meets the requirements of GDPR Article 28, and where personal data is transferred outside the EU, an appropriate transfer mechanism is in place.
This list is published with a full version history. We notify controllers before adding or replacing a sub-processor, as agreed in the data processing agreement, and every change to this list is released as a new version with an effective date and a plain-language change summary — see Section 4.
2. Active Sub-processors
| Sub-processor | Purpose | Personal data involved | Processing region | Transfer safeguard |
|---|---|---|---|---|
| Vercel | Application hosting and delivery | HTTP requests, rendered pages, IP addresses | EU (application runtime); US (DDoS/network protection layer) | EU-US Data Privacy Framework |
| Google Cloud | Core infrastructure: database, authentication, file storage, compute, AI processing (Gemini Enterprise Agent Platform) | All platform data | EU — primary region europe-north1 (Finland)¹ | Not transferred outside the EU¹ |
| Mistral AI | AI processing (fallback provider) | Profile text, messages | EU (France) | No transfer |
| Deepgram | Voice transcription | Audio recordings | EU endpoint | No transfer |
| Resend | Transactional email delivery | Email addresses, notification content | US | EU Standard Contractual Clauses + EU-US Data Privacy Framework |
| Upstash | Rate limiting (abuse prevention) | Hashed IP addresses, request counts | EU | No transfer |
| Cloudflare | Content delivery network, live video streaming | HTTP metadata, live video streams (transient) | Global edge network; recordings stored in the EU | EU Standard Contractual Clauses + EU-US Data Privacy Framework |
| Optional sign-in (OAuth) — engaged only when a user chooses to sign in with LinkedIn | Name, email, LinkedIn profile ID | US | User-initiated transfer | |
| Sentry | Application error and performance monitoring | Technical error reports: stack traces, URLs, browser/OS metadata — personal data scrubbed before send, no IP addresses stored; account and organization metadata | EU (Frankfurt — EU data residency); US (account and organization metadata only) | EU-US Data Privacy Framework + EU Standard Contractual Clauses |
¹ See Section 3 for how AI processing regions are governed.
3. AI Processing Regions
By default, all AI processing runs on EU infrastructure: Google Cloud (Gemini Enterprise Agent Platform) in the EU, and Mistral AI in France as fallback provider. AI model and provider selection is configurable per event; enabling any non-EU endpoint requires explicit acknowledgment by the event organizer and is logged for accountability. Google's Cloud Data Processing Addendum applies to all AI endpoints.
4. Changes to This List
Before adding or replacing a sub-processor, we notify controllers in accordance with the data processing agreement, giving them the opportunity to object.
Each revision of this list is published as a new immutable version with its own effective date and change summary. You can review every change in the version history — including a side-by-side comparison of any two versions — and in the combined changelog.
Questions? Contact us at info@lataamo.fi
Version history
Compare versionsVersion 3Current
Effective July 13, 2026
Removed Lyyti — registration import is not currently in use; it will be re-listed with prior notice if an event enables it. Simplified the AI processing region description and unified naming.
Version 2
Effective July 2, 2026
Added Sentry (application error monitoring) — error data is hosted in Sentry's EU region (Frankfurt); only account and organization metadata is processed in the US under the EU-US Data Privacy Framework and Standard Contractual Clauses.
Version 1
Effective July 2, 2026
Initial published version — public list of the sub-processors engaged to operate the platform.