Updated 2026-09-14

Subprocessor register

List of external entities processing personal data on behalf of Polska Grupa Wierzytelności. Every change is announced with 30 days' notice.During this period, a corporate client may object in writing to the contact address given in the Privacy Policy.

Active subprocessors

Entities currently involved in data processing in the production environment.

Supabase

Supabase Inc.

HIGH Active, DPA signed

Service: Managed PostgreSQL (database), Storage (document scans), Auth (sign-in). The platform's production environment.
Scope of data: Full scope of application data: user accounts, cases, documents and correspondence. Actual client and debtor data.
Location: European Union — `eu-central-1` region (Frankfurt, Germany); infrastructure: Amazon Web Services as Supabase's provider
DPA / formal status: DPA signed on 2026-05-22 (erratum in progress). Planned database migration to Azure Poland Central; see “Planned”.

Microsoft Azure Container Apps

Microsoft Corporation

HIGH Active, DPA signed

Service: Application hosting (server layer and API). Every user request passes through this layer; data is processed in memory and diagnostic logs.
Scope of data: Data passing through the application during request handling: processed in memory, WITHOUT persistent storage (the database and files remain with Supabase). Technical logs contain no case content (Azure Monitor / Log Analytics).
Location: EU. Poland Central
DPA / formal status: Covered by the Microsoft DPA / Azure Online Services Terms.

Microsoft Azure Communication Services

Microsoft Corporation

HIGH Active, DPA signed

Service: Sending the platform's outgoing email (notifications and correspondence to clients and debtors). This is the actual technical sender of messages.
Scope of data: Content and recipients of emails sent by the platform.
Location: EU
DPA / formal status: Covered by the Microsoft DPA / Azure Online Services Terms.

Accounting services (inFakt)

inFakt sp. z o.o., KRS 0000325203

HIGH Active, DPA in progress

Service: Bookkeeping, issuing and recording invoices, tax settlements and payroll administration.
Scope of data: Data from invoices issued to clients (name, address, NIP tax number, amounts) and bank account records, including debtor payments and payment references. Employee HR and payroll data.
Location: Poland — Kraków
DPA / formal status: Data processing agreement: status to be confirmed.

Microsoft Azure OpenAI

Microsoft Corporation

HIGH Active, DPA in progress

Service: Language models (LLMs) + embeddings for the legal assistant, RAG over case files and document analysis. Microsoft does NOT use customer data to train models. The sole AI provider (no models outside Microsoft).
Scope of data: Question content and case context after anonymisation: layer 1 regex (PESEL/NIP/IBAN/email/phone) + layer 2 NER (names/addresses/companies).
Location: EU. Poland Central (preferred) / Sweden Central (fallback)
DPA / formal status: Azure OpenAI DPA awaiting signature (Microsoft Product Terms / DPA).

Microsoft Azure AI Language

Microsoft Corporation

HIGH Active, DPA signed

Service: Personal data recognition and masking (NER PII), the second anonymisation layer before sending to AI (names, addresses, company names). Fail-closed.
Scope of data: Text fragments destined for AI, to detect and mask PII. No persistent storage.
Location: EU. Sweden Central
DPA / formal status: Covered by the Microsoft DPA (Azure Cognitive Services).

Microsoft Azure Document Intelligence

Microsoft Corporation

HIGH Active, DPA signed

Service: Document OCR (invoices, agreements, correspondence), extracting text for further processing.
Scope of data: Contents of uploaded case documents (scans). OCR results are stored in our database.
Location: EU. Sweden Central
DPA / formal status: Covered by the Microsoft DPA (Azure Cognitive Services).

Microsoft Azure Maps

Microsoft Corporation

MEDIUM Active, DPA signed

Service: Geocoding and address suggestions (countrySet=PL), map visualisation. Server-side key (Managed Identity).
Scope of data: Addresses (street, city, postcode) submitted for geocoding. No personal identifiers.
Location: EU (atlas.microsoft.com)
DPA / formal status: Covered by the Microsoft DPA (Azure Maps).

Planned / conditional

Entities that may be engaged in future once conditions are met (DPA + 30 days' notice).

Planned

Microsoft Azure (PostgreSQL Flexible Server / Blob / Key Vault / Entra ID)

Migration of the database, file storage and sign-in from Supabase to Azure. Poland Central region. The application layer already runs on Azure; see “Active”.

Part of the Azure Online Services Terms / Data Protection Addendum (Microsoft).

Planned

Microsoft Graph (Microsoft 365)

Sending and reading email from the organisation's mailbox. Currently disabled by a feature flag; Azure Communication Services handles outgoing email.

Covered by the Microsoft DPA / Online Services Terms. Activation after App Registration configuration.

Planned

Microsoft Azure Cache for Redis

Distributed rate limiter (replacing Upstash), Poland Central region, within the Microsoft/EU boundary.

Part of the Azure Online Services Terms / DPA.

Planned

Autenti

Qualified electronic signing of agreements (no equivalent in Microsoft services). Conditional activation; currently disabled by a feature flag.

Requires a signed DPA and verification before activation.

What is NOT a subprocessor

Deliberately excluded from the register, with reasons.

Web Push (VAPID)

Self-hosted. Notifications go directly from our server to the browser. The payload is generic, with no message content or personal data.

Microsoft Entra ID

The administrator's identity system (Insignis Polska). It does not process PGW client data within the meaning of Article 28 GDPR.

Have a question about data processing?

Get in touch with the data controller, we respond without undue delay and no later than within one month (Article 12(3) GDPR).

iod@e-pgw.pl Privacy policy

Updated 2026-09-14