September 2026
R2 Sistemas Informáticos, S.L. (“R2 Sistemas”) publishes on this page the list of sub-processors it engages to provide the R2 Docuo service (the “Service”), stating their identity, the service they provide and the country in which they process the data, in accordance with Clause 13.6 of the Conditions, as well as the locations in which it processes personal data on behalf of its customers, in accordance with Clause 13.7. Capitalised terms have the meaning given to them in the Conditions.
This list covers the third parties that process personal data for which the User is the controller, on behalf of R2 Sistemas and for the sole purpose of providing the Service. R2 Sistemas imposes on each of them, by contract, the same data protection obligations set out in Clause 13 of the Conditions, and remains liable to the User for their performance.
The following are not sub-processors of R2 Sistemas and do not appear in this list:
– The MCP Client and the AI Provider that the User chooses and contracts in order to access the Service through the MCP Server. It is for the User to put in place a processing agreement with them, in accordance with Clause 13.6.
– The model provider with which the User holds its own account, where the User configures an AI Feature to use it, in accordance with Clause 21.h.
– The providers that process personal data for which R2 Sistemas is the controller, such as those of the R2 Docuo Website or those of its own invoicing, which are described in the Privacy Policy.
– Service: hosting of the infrastructure on which the Service is provided and the Repositories, including their backups, are stored.
– Country of processing: Spain.
– International transfers: none. Processing takes place entirely within the European Economic Area.
– Website: https://www.stackscale.com
– Service: hosting of a second backup copy of the Repositories and of the Account data, in a physical location different from that in section 2.1, in accordance with the dual-location requirement of the Spanish National Security Framework (Esquema Nacional de Seguridad) at HIGH category.
– Contracting entity: Altair Networks, S.L., Avenida de los Rosales 42, 28021 Madrid, Spain (tax identification number B-81579971).
– Country of processing: Spain.
– International transfers: none. Processing takes place entirely within the European Economic Area.
– Encryption: the backups are stored encrypted and R2 Sistemas does not provide the provider with the encryption key, so it does not access the content of the Repositories or the personal data they contain.
– Website: https://www.altair-networks.com
In accordance with Clause 21.h of the Conditions, the providers of the language models with which the AI Features are executed act as sub-processors of R2 Sistemas where the operation is executed using the R2 Sistemas account, whether the model is determined by R2 Sistemas or chosen by the User from those the Service offers. The provider involved in each operation is that of the model executing it. R2 Sistemas transmits to them only the content and the metadata of the document needed to attend to each request, to the extent the User has configured, and does not authorise them to use it to train or fine-tune their models. Where the User configures an AI Feature with its own account with the provider, that provider does not act as a sub-processor of R2 Sistemas. As at the date of this list the providers are the following, through their entities established in the European Union:
– Service: language models for the AI Features.
– Contracting entity: Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland (registration no. 760497).
– Country of processing: this provider does not currently offer processing within the European Union. Inference runs on global routing, which the provider may direct to the United States and to other countries in Europe, Asia and Oceania with no guarantee of a specific location, and the associated storage is located in the United States.
– International transfers: yes. They rely on the standard contractual clauses approved by the European Commission, incorporated into the data processing agreement entered into with the provider.
– Retention and review: the provider retains the transmitted content for up to thirty (30) days for the abuse monitoring provided for in its terms, in the course of which access by its personnel is possible. It does not use it to train or fine-tune its models.
– Website: https://www.anthropic.com
– Service: language models for the AI Features.
– Contracting entity: OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (registration no. 737350).
– Country of processing: the United States and other countries outside the European Economic Area. R2 Sistemas has not contracted with this provider the European data residency option that it offers to business customers.
– International transfers: yes. They rely on the standard contractual clauses approved by the European Commission, incorporated into the data processing agreement entered into with the provider.
– Retention and review: the provider retains the transmitted content for the period provided for in its terms for the purposes of abuse monitoring, in the course of which access by its personnel is possible. It does not use it to train or fine-tune its models.
– Website: https://openai.com
– Service: language models for the AI Features.
– Contracting entity: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland.
– Country of processing: Spain. Inference runs through a regional endpoint in the Madrid region (europe-southwest1), with residual use of other European Union regions.
– International transfers: none. Processing takes place entirely within the European Union.
– Retention and review: governed by the data processing terms of the provider’s enterprise platform, which do not authorise the use of the transmitted content to train or fine-tune its models.
– Website: https://cloud.google.com
R2 Sistemas processes the personal data covered by Clause 13 of the Conditions within the European Economic Area. The servers on which the Service is provided and the Repositories and their backups are stored are located in Spain. Save as expressly stated for a specific sub-processor in this list, R2 Sistemas does not carry out or permit transfers of that data to third countries or to international organisations. The express exception to that rule is the AI Features where they are executed with the providers in section 3 that process outside the European Economic Area. The User may avoid that exception by keeping the AI Features disabled in its Repository, in accordance with Clause 21.i) of the Conditions. The addition of a processing location outside the European Economic Area would be notified to the User with the prior notice and the right to object provided for in Clause 13.7.
R2 Sistemas notifies the User of the addition or replacement of a sub-processor at least one (1) month in advance, by email to the address registered for the Account, and updates this page on that same date. During that period, the User may object on reasonable data protection grounds by means of a Support Ticket. If the objection prevents the Service from being provided on equivalent terms, the User may terminate the affected Licences at no cost or penalty, with a refund of the part of the Fee corresponding to the unused period, in accordance with Clause 13.6.
– September 2026: first publication of this list.
