Schedule 2 to Data Processing Agreement

List of Sub-Processors

This list is, as updated in accordance with the Data Processing Agreement (DPA), the operative list for the purposes of the DPA.

Microsoft Ireland Operations Ltd#

Entity: Microsoft Ireland Operations Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland
Service: Cloud infrastructure and hosting (Microsoft Azure), including compute, database, storage, AI model inference, document processing, key management, monitoring and networking services deployed within the Company's Azure tenant.
Personal Data Affected: All categories of Personal Data listed in clause 4 (identification, policy and claim reference, claim-related data including Sensitive Personal Data where the claim requires it, and financial data), together with platform telemetry (request metadata, error traces) and authorised-user account data.
Location: Switzerland North (Zurich) for all data at rest and primary processing. No ancillary Azure service processes Personal Data outside Switzerland or the EEA.

Entity: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Service: Business productivity and communications suite (Google Workspace), including email, document storage and calendar services used for client communications and operational coordination, including correspondence that may contain claim-related Personal Data submitted by the Client outside the Platform.
Personal Data Affected: Identification data and any claim-related Personal Data voluntarily included by the Client or Data Subjects in email correspondence or shared documents.
Location: European Union (Google Workspace data region configured for Europe). Governed by the Google Cloud / Workspace Data Processing Addendum and EU Standard Contractual Clauses.

Entity: Slack Technologies Limited, 4th Floor, One Park Place, Hatch Street Upper, Dublin 2, D02 W085, Ireland
Service: Internal team-communication platform used by Company personnel for operational coordination and troubleshooting, in which claim-related Personal Data may be referenced.
Personal Data Affected: Identification data and any claim-related Personal Data voluntarily referenced by personnel in messages, threads or shared files.
Location: European Union (Slack EU data residency configured for messages and shared files at rest). Governed by the Slack Customer Terms of Service Data Processing Addendum.

Date of last update: 2026-08-17

Version	Effective Date	Summary of Changes
1.0	2026-08-17	Initial publication as Schedule 2 to the Data Processing Agreement dated 2026-08-16.