GDPR Chapter V transfer register and safeguards · Qureos
The Comp AI task allows de-scoping only "if no data sent into or out of the EU." That condition is not met. Qureos processes EU personal data as a matter of architecture, not incident:
europe-west1 (Belgium), with MongoDB Atlas in the same region. Data leaving this
environment to any third-country recipient is an international transfer under GDPR Ch. V.Conclusion: the task is applicable and must not be marked "not relevant". This document is the transfer review it requires.
Every third-country recipient of personal data, mapped to its RoPA processing activity. The operative safeguard relied on is the vendor's Data Processing Agreement incorporating the 2021 EU Standard Contractual Clauses (Art. 46(2)(c)); vendor EU–US Data Privacy Framework certifications, where held, are treated as supplementary and are not relied on as the primary mechanism.
| # | Recipient | Country | Purpose (RoPA activity) | Personal data transferred | Transfer mechanism | Status |
|---|---|---|---|---|---|---|
| T1 | Google Cloud Platform (Google LLC) | US (data at rest in EU) | Hosting, storage, logging (RoPA 1, 2, 8, 10) | All platform data; at rest in europe-west1; support/remote access may occur from outside EEA | Google Cloud Data Processing Addendum incorporating SCCs | SCC |
| T2 | MongoDB Atlas (MongoDB Inc.) | US (cluster in EU) | Primary database (RoPA 1, 5) | Candidate and customer records; cluster hosted in EU | MongoDB DPA incorporating SCCs | SCC |
| T3 | Elastic (Elasticsearch) | US/NL | Search index (RoPA 1) | Candidate profile search fields | DPA incorporating SCCs | SCC |
| T4 | OpenAI | US | LLM scoring & report generation (RoPA 3) | Interview transcripts, profile data (API traffic; zero-retention terms, no training on customer data) | OpenAI DPA incorporating SCCs | SCC |
| T5 | Google (Gemini API) | US | Profile analysis (RoPA 3) | Profile data (API traffic) | Google Cloud DPA incorporating SCCs (as T1) | SCC |
| T6 | LiveKit | US | Real-time interview infra & recording (RoPA 2) | Voice/video streams, call metadata | DPA incorporating SCCs | SCC |
| T7 | Deepgram | US | Speech-to-text (RoPA 2) | Interview audio, transcripts | DPA incorporating SCCs | SCC |
| T8 | Twilio | US | SMS, calls, phone interviews (RoPA 2, 6) | Phone numbers, call audio/metadata | Twilio DPA incorporating SCCs | SCC |
| T9 | Retell | US | Phone interviews (RoPA 2) | Phone numbers, call audio, transcripts | DPA incorporating SCCs | SCC |
| T10 | Stripe | US | Payments (RoPA 5) | Billing contact, tokenized payment data (PCI-DSS) | Stripe DPA incorporating SCCs | SCC |
| T11 | Intercom | US | Customer support (RoPA 7) | Name, email, support conversation content | Intercom DPA incorporating SCCs | SCC |
| T12 | Postmark (ActiveCampaign) | US | Transactional email (RoPA 6) | Email addresses, message content/metadata | DPA incorporating SCCs | SCC |
| T13 | Bird / WhatsApp Business API | NL / US (Meta) | WhatsApp reminders (RoPA 6) | Phone numbers, template message metadata | Bird (EU entity) DPA; Meta transfers under SCCs in the WhatsApp Business terms | SCC |
| T14 | Nylas | US | Gmail reply detection (RoPA 6) | Reply status metadata only (no message content) | DPA incorporating SCCs | SCC |
| T15 | Okta / Auth0 | US | Authentication (platform & workforce) | Login identifiers, authentication events | Okta DPA incorporating SCCs | SCC |
| T16 | Mixpanel | US | Product analytics (RoPA 8) | Usage events, identifiers | DPA incorporating SCCs | SCC |
| T17 | Segment (Twilio) | US | Event pipeline (RoPA 8) | Usage events, identifiers | Twilio DPA incorporating SCCs (as T8) | SCC |
| T18 | New Relic | US | Performance monitoring (RoPA 8) | Service telemetry; may incidentally include identifiers | DPA incorporating SCCs | SCC |
| T19 | Google Workspace | US | Workforce identity, email, docs (RoPA 9) | Employee data; business documents | Google Workspace DPA incorporating SCCs | SCC |
| T20 | Comp AI (trycomp.ai) | US | Compliance personnel register (RoPA 9) | Employee names, roles, onboarding data | DPA incorporating SCCs | SCC |
| T21 | ContactOut | US | Contact enrichment (RoPA 4) | Sourced-candidate contact details | Vendor terms only — SCC-backed DPA not yet confirmed on file | VERIFY |
| T22 | Clay | US | Contact enrichment (RoPA 4) | Sourced-candidate contact details | Vendor terms only — SCC-backed DPA not yet confirmed on file | VERIFY |
| T23 | Qureos group entities (intra-group) | UAE / US / KSA | Platform administration, support, engineering access to EU-hosted systems | Any platform data reachable by least-privilege admin access | Access controls (SSO + MFA, least-privilege IAM, no standing prod credentials); intra-group SCC agreement pending (R3) | OPEN |
Register derived from the Art. 30 RoPA (reviewed 2026-08-17) and the Qureos Data Processing Agreement sub-processor schedule (updated 2025-08-15, published at app.qureos.com/policies).
| Mechanism | GDPR basis | Where used |
|---|---|---|
| Adequacy decision — United Kingdom | Art. 45 | EU↔UK data flows (UK is within the served market; no additional safeguard required while the UK adequacy decision stands) |
| Standard Contractual Clauses (2021, module 2/3) via vendor DPAs | Art. 46(2)(c) | All US sub-processors in §3; the operative mechanism for every routine transfer |
| Supplementary measures | Schrems II | Encryption in transit (TLS 1.2+) and at rest; EU data residency for storage; zero-retention API terms for LLM traffic (OpenAI); tokenization (Stripe); metadata-only scope (Nylas) |
| Contractual flow-down | Art. 28(4) | Qureos DPA obliges sub-processor equivalence: ISO 27001 and/or SOC 2 baseline, DPAs with SCCs for transfers outside the EEA/UK, customer objection rights on sub-processor changes |
Derogations under Art. 49 are not relied on for any routine transfer.
me-central2). Staging holds no production personal data
(see environment-separation evidence: separate VPCs, clusters, and database clusters; staging
identities cannot reach production). EU personal data therefore does not flow to KSA infrastructure.| # | Finding | Compensating position | Remediation |
|---|---|---|---|
| R1 | ContactOut and Clay (contact enrichment) are engaged on standard vendor terms; an SCC-backed DPA is not confirmed on file (T21, T22) | Data involved is public-professional-source contact data, lowest-sensitivity category in the register; erasure honored within 30 days | Obtain/confirm DPAs incorporating SCCs with both vendors, or replace them; target next quarterly vendor review |
| R2 | Transfer Impact Assessments (Schrems II) are not yet documented per US sub-processor | Supplementary measures already operate (§4); all vendors meet the ISO 27001 / SOC 2 baseline | Produce lightweight TIAs for the highest-volume recipients first (OpenAI, LiveKit, Deepgram, Twilio, Stripe) |
| R3 | Intra-group third-country access (UAE/US/KSA workforce administering EU-hosted systems) is not yet covered by a signed intra-group transfer agreement (T23) | Access is least-privilege with no standing production credentials, SSO + enforced MFA, and full audit logging of admin activity | Execute an intra-group data transfer agreement incorporating SCCs between the UAE, US, and KSA entities |
| R4 | DPIA for automated candidate scoring / profiling (GDPR Art. 22, EU AI Act high-risk) remains open; it will also cover the transfer dimension of LLM scoring | Art. 22 safeguards operate: human review of every shortlist, right to explanation and objection; zero-retention LLM API terms | Complete the DPIA (already tracked as an open action on the RoPA) |
This register is reviewed annually and on any sub-processor addition, removal, or change of processing
location, in step with the Art. 30 RoPA and the DPA sub-processor schedule. The Comp AI task
tsk_6a2e519f286b951ea31f1619 ("Review International Data Transfers", GDPR framework) is the
recurring trigger; this document is its evidence. Customers are notified of sub-processor changes under
the DPA's objection mechanism.
Sources: Records of Processing Activities (Art. 30 register, reviewed 2026-08-17) · Qureos Data Processing Agreement (updated 2025-08-15, app.qureos.com/policies) · hosting & compliance response (GCP europe-west1, vendor certifications) · environment-separation control evidence (staging isolation) · Comp AI system description and vendor records. Prepared 2026-08-17 for the Qureos GDPR compliance program; internal document, disclosed to auditors and supervisory authorities on request.