# Sub-Processor Change Notification

> **Document Version:** 1.0  
> **Document Owner:** Acme Inc  
> **Next Review Date:** 2027-03-19


**From:** Acme Inc
**Date:** 2026-03-19
**Subject:** Notice of Sub-Processor Change

## Related Documents

- Sub-Processor List (`SUBPROCESSOR_LIST.md`)
- Data Processing Agreement (`DATA_PROCESSING_AGREEMENT.md`)
- Third-Party Risk Assessment (`THIRD_PARTY_RISK_ASSESSMENT.md`)

---

## 1. Purpose of This Notice

In accordance with our Data Processing Agreement (DPA) and applicable data protection regulations (including GDPR Article 28), Acme Inc is providing this notice regarding changes to the sub-processors used in connection with our services.

This notification is sent to all customers and data controllers who have entered into a DPA with us, as required under our contractual obligations.

## 2. Sub-Processor Change Details

### New Sub-Processor(s)

| Field | Details |
|-------|---------|
| **Sub-Processor Name** | [New Sub-Processor Name] |
| **Purpose of Processing** | [Description of processing activities] |
| **Data Processed** | [Types of personal data processed] |
| **Location** | [Country/Region] |
| **Transfer Mechanism** | [SCCs / Adequacy Decision / BCRs] |
| **DPA Status** | [Signed / Pending] |
| **Effective Date** | [Date when processing will begin] |

### Removed Sub-Processor(s)

| Field | Details |
|-------|---------|
| **Sub-Processor Name** | [Removed Sub-Processor Name] |
| **Reason for Removal** | [Contract expiry / Replacement / Service change] |
| **Data Deletion Date** | [Date when data will be deleted/returned] |
| **Effective Date** | [Date when processing ceased] |

### Replaced Sub-Processor(s)

| Field | Details |
|-------|---------|
| **Previous Sub-Processor** | [Name] |
| **New Sub-Processor** | [Name] |
| **Reason for Replacement** | [Better security / Cost / Feature requirements] |
| **Data Migration Plan** | [How data will be transferred] |
| **Effective Date** | [Date of switchover] |

## 3. Current Sub-Processor List

For reference, the following sub-processors are currently engaged:

| Sub-Processor | Purpose | Data Processed |
|--------------|---------|---------------|
| Sentry | Error tracking and performance monitoring | error data, stack traces, user context, device information, IP address |
| Supabase | User authentication and identity management | email, password hash, session data, user metadata |
| OpenAI | AI processing and content generation | user prompts, conversation history, generated content |
| PostHog | Product analytics and usage tracking | user behavior, session recordings, feature flag usage, device information |
| Resend | Transactional and marketing email delivery | email addresses, email content |
| Stripe | Payment processing and billing | payment information, billing address, email, transaction history |
| stripe-ios | Payment processing and billing | payment information, billing address, email, transaction history |

The complete and up-to-date sub-processor list is maintained at https://acme-saas.com/legal/sub-processors (or in the `SUBPROCESSOR_LIST.md` document).

## 4. Due Diligence Undertaken

Before engaging any new sub-processor, Acme Inc conducts the following assessments:

- **Security Assessment** — Review of the sub-processor's security measures, certifications (SOC 2, ISO 27001), and incident response capabilities
- **Privacy Assessment** — Review of data processing practices, privacy policy, and DPA terms
- **Legal Assessment** — Evaluation of applicable law, transfer mechanisms, and regulatory compliance
- **Contractual Safeguards** — Execution of a Data Processing Agreement with Standard Contractual Clauses where required

## 5. Your Right to Object

In accordance with our DPA, you have the right to object to the appointment of a new sub-processor. To exercise this right:

1. **Objection Period:** You have **30 days** from the date of this notification to raise an objection.
2. **How to Object:** Send your objection in writing to dpo@acme-saas.com with:
   - Your company name and DPA reference number
   - The specific sub-processor you are objecting to
   - The grounds for your objection
3. **Resolution Process:**
   - Acme Inc will acknowledge your objection within 5 business days
   - We will work with you in good faith to find a reasonable resolution
   - If no resolution can be reached, either party may terminate the affected services in accordance with the DPA

If no objection is received within the objection period, the sub-processor change will proceed as described above.

## 6. Impact on Data Protection

Acme Inc confirms that this sub-processor change:

- [ ] Does not reduce the overall level of data protection provided under the DPA
- [ ] Maintains equivalent or stronger security measures
- [ ] Does not change the categories of personal data processed
- [ ] Does not extend data processing to new jurisdictions without appropriate safeguards
- [ ] Includes appropriate contractual protections (DPA/SCCs)

## 7. Contact Information

For questions about this sub-processor change notification:

- **Privacy/DPO Contact:** dpo@acme-saas.com
- **General Contact:** legal@acme.com
- **Sub-Processor List:** https://acme-saas.com/legal/sub-processors

---

*This Sub-Processor Change Notification template was auto-generated by [Codepliant](https://github.com/joechensmartz/codepliant) based on code analysis. Complete the bracketed fields before sending to customers. Review with legal counsel to ensure compliance with your specific DPA obligations.*
