Sous-traitants
Version du registre 1.0 · Récupéré 20 octobre 2026 · Flux RSS · JSON
Clozo (Andrei Diachenko, micro-entrepreneur exerçant sous le nom commercial de Clozo) recourt aux sous-traitants suivants pour fournir le service. Ce registre est publié au titre de l'article 28(2) du RGPD. Nous donnons un préavis de 30 jours avant l'ajout d'un nouveau sous-traitant — abonnez-vous ci-dessous pour recevoir des notifications.
Pour la description complète de la manière dont nous utilisons vos données personnelles, consultez notre Politique de confidentialité §6.
| Sous-traitant | Pays | Service | Catégories de données | Mécanisme de transfert | Politique de confidentialité | CTD |
|---|---|---|---|---|---|---|
| Stripe Payments Europe Ltd. | Ireland (EU) | Processes card payments for paid subscriptions and for invoices that customers pay through Clozo. | Email, name, IP address, payment-method details (card brand and last four digits), billing address, and the amount and currency of each transaction. | EU/EEA only — no third-country transfer Data is processed in the EU (Ireland). Payments can pass between Stripe's legal entities as part of normal payment processing. | Link ↗ | Link ↗ |
| Cloudflare, Inc. | USA (with EU edge) | Delivers the website quickly, protects it from attacks, and stores uploaded files such as PDF invoices and company logos. | IP addresses (truncated at the network edge, and hashed with a daily-rotating salt when counting link clicks), browser family, and uploaded files (logos, PDF invoices). | USA — Standard Contractual Clauses (Commission 2021/914) Covered by Standard Contractual Clauses. Content is delivered from European network locations. | Link ↗ | Link ↗ |
| Functional Software, Inc. (Sentry) | USA | Detects and diagnoses errors and slow pages so that problems can be fixed. | Error details, page addresses and browser type. Personal data is scrubbed before sending; email addresses and full request contents are not sent. | USA — Standard Contractual Clauses (Commission 2021/914) Covered by Standard Contractual Clauses. Sentry's EU region is used where available. | Link ↗ | Link ↗ |
| PostHog Inc. | USA | Product usage analytics and optional session recordings on paid plans. Nothing is sent unless you accept analytics. | An anonymous identifier, event names and properties such as pages viewed and buttons clicked. Events are linked to your account only after you sign in. Session recordings mask personal data. | USA — Standard Contractual Clauses (Commission 2021/914) Covered by Standard Contractual Clauses. Data is currently routed through the United States. | Link ↗ | Link ↗ |
| Microsoft Corporation (Clarity) | USA | Session analytics and heatmaps on the public marketing pages only. Loaded after you accept analytics, and never inside the signed-in product. | Pages visited, clicks and taps, scrolling and pointer movement, referrer, campaign parameters, browser, device and operating-system family, approximate region and a pseudonymous session identifier. Financial and client data is never recorded. | USA — EU-US Data Privacy Framework (DPF) Transfer to the United States under the EU-US Data Privacy Framework (Microsoft is certified), supplemented by Standard Contractual Clauses. Microsoft may process Clarity data for its own purposes under its Clarity terms. | Link ↗ | Link ↗ |
| Resend, Inc. | USA | Sends the e-mails Clozo produces: welcome messages, one-time codes, password resets, invoice delivery, privacy-request confirmations and sub-processor change notices. | Email address, subject line and message body. Delivery logs are not kept for more than 30 days. | USA — Standard Contractual Clauses (Commission 2021/914) Covered by Standard Contractual Clauses. | Link ↗ | Link ↗ |
| BRBX BV (Recommand) | Belgium | Certified Peppol access point. Where e-invoicing networks are switched on (early access), it sends business customers' invoices over Peppol and receives their suppliers' invoices. Also lists the participant's address in the network directory when receiving is enabled. | The complete structured invoice: legal name, postal address, VAT number, registration number, seller contact name, phone and e-mail, bank account number and BIC, invoice number, dates, line items and amounts. | EU/EEA only — no third-country transfer Established in Belgium; sending involves no transfer outside the EEA. The invoice is then delivered to the access point the recipient has chosen, which may be outside the EEA; that is the recipient's own choice of route, not a Clozo sub-processor. The provider keeps a copy for about 365 days; Clozo keeps the legal original for the statutory period. | Link ↗ | Link ↗ |
| Didit | Spain | Identity verification of the authorised representative of a company, required before the company's address can be registered in the Peppol directory. Done once per company at onboarding, not per invoice. | Identity-document data of the representative: name, date of birth, document number and type, issuing country, document image and a liveness selfie. No invoice content and no client financial data. | EU/EEA only — no third-country transfer EU-established; no transfer outside the EEA. Reached through the access point's verification flow, which is why it is listed here even though Clozo has no separate contract with it. | Link ↗ | — |
| Crisp IM SAS | France (EU) | Live-chat support on the Clozo website. For a signed-in user who has accepted analytics, the chat is opened with the user's identity, not only with what is typed into it. | Email address and full name of a signed-in user (shared on every signed-in session, whether or not the chat is opened); plan, country, whether a payment account is connected, user id and interface language; the conversation transcript; IP address; browser. | EU/EEA only — no third-country transfer EU-based provider; data is hosted in the EU (France). | Link ↗ | Link ↗ |
| Geoapify GmbH | Germany (EU) | Address autocomplete in account settings, used to fill in street, postal code, city and country correctly for e-invoices. | The partial address text you type into the autocomplete. Clozo does not store it beyond the live session. | EU/EEA only — no third-country transfer EU-based provider, processing in Germany. No transfer outside the EU. | Link ↗ | Link ↗ |
| Google LLC (Gemini API) | USA | AI assistance in the proposal editor (text expansion, translation, drafting of service agreements) and, only where it is switched on, automatic reading of supplier invoices uploaded by business customers (an early-access feature). | Proposal text and item names, with client names, e-mail addresses, bank account numbers and amounts removed before sending. For an AI-drafted service agreement, the identifying details of both parties (names, addresses, VAT numbers, e-mail addresses) are sent, because a contract cannot be drafted without them. For automatic reading of supplier invoices, the complete uploaded document is sent (supplier name, address, VAT number, bank details, invoice number, dates, line items and amounts); it can be switched off for an organisation on request. The client list, billing data and invoice totals are not sent. | USA — EU-US Data Privacy Framework (DPF) Transfer to the United States under the EU-US Data Privacy Framework (Google is a certified participant), with Google's data processing terms as the contract. Google does not use paid-tier API prompts or outputs to train its models. | Link ↗ | Link ↗ |
| Gotenberg (self-hosted) | EU (Railway hosting) | Renders invoices and proposals as PDF files. It runs as part of Clozo's own infrastructure in the EU. | The invoice or proposal content passed in for conversion. Nothing is retained. | EU/EEA only — no third-country transfer Self-hosted in the EU. Not a third-party processor; listed for transparency. | Link ↗ | — |
Modifications récentes
- 22 août 2026 · Updated · Crisp IM SASUpdated: Crisp IM SAS — corrected: the email address and full name of a signed-in user are shared with the chat widget on every signed-in session, not only when typed into the chat. What is sent did not change; only what the register says is sent.
- 30 juil. 2026 · Added · DiditAdded: Didit (Spain) — Identity verification of the authorised representative of a company, required before the company's address can be registered in the Peppol directory. Done once per company at onboarding, not per invoice.
- 30 juil. 2026 · Added · BRBX BV (Recommand)Added: BRBX BV (Recommand) (Belgium) — Certified Peppol access point. Where e-invoicing networks are switched on (early access), it sends business customers' invoices over Peppol and receives their suppliers' invoices. Also lists the participant's address in the network directory when receiving is enabled.
- 20 juil. 2026 · Updated · Google LLC (Gemini API)Updated: Google LLC (Gemini API) — the data categories now also cover automatic reading of supplier invoices for business customers. The complete supplier-invoice document is sent for extraction, under the EU-US Data Privacy Framework and Google's data processing terms. It can be switched off for an organisation on request.
- 20 juil. 2026 · Updated · Anthropic PBCUpdated: Anthropic PBC — its description in the register was revised.
- 18 juil. 2026 · Removed · Anthropic PBCRemoved: Anthropic PBC (USA) — Clozo no longer sends any data to Anthropic. Replaced by Google LLC (Gemini API).
- 18 juil. 2026 · Added · Google LLC (Gemini API)Added: Google LLC (Gemini API) (USA) — AI assistance in the proposal editor (text expansion, translation, drafting of service agreements) and, only where it is switched on, automatic reading of supplier invoices uploaded by business customers (an early-access feature).
- 05 juin 2026 · Added · Microsoft Corporation (Clarity)Added: Microsoft Corporation (Clarity) (USA) — Session analytics and heatmaps on the public marketing pages only. Loaded after you accept analytics, and never inside the signed-in product.
- 16 mai 2026 · Updated · Anthropic PBCUpdated: Anthropic PBC — corrected the service description. The AI text feature is part of the paid plan and has no separate per-user opt-in.
- 16 mai 2026 · Updated · Anthropic PBCUpdated: Anthropic PBC — corrected the service description. The AI text feature is part of the paid plan and has no separate per-user opt-in.
- 13 mai 2026 · Added · Stripe Payments Europe Ltd.Initial sub-processor register published.
Recevoir un préavis de 30 jours en cas de changement
Nous vous enverrons un e-mail 30 jours avant l'ajout, la suppression ou la modification d'un sous-traitant. Double opt-in — vous recevrez d'abord un e-mail de confirmation.
Politique de confidentialité·Contrat de traitement des données·Conditions d'utilisation·Mentions légales