Published in accordance with the Data Processing Agreement (Exhibit C, OVR-SCH-003) and Article 28 GDPR, at oramavr.com/legal/sub-processors. This register is the single operative sub-processor list for all ORamaVR agreements: the DPA annexes and ORamaVR’s privacy documentation point to this register and do not restate it. ORamaVR gives 30 days’ prior notice of any intended addition or replacement of a sub-processor.
Current sub-processors
| Sub-processor | Service | Location | Transfer safeguard |
|---|---|---|---|
| OpenAI, L.L.C. | LLM inference for JARIA in-session guidance (GPT-4o-class models) and OMEN image generation. Data processed: trainee voice transcript, serialised scene state, IFU corpus references | United States | EU-US Data Privacy Framework + 2021 SCCs (Module 2); UK Addendum executed per customer; FDPIC supplemental measures (Switzerland) |
| Microsoft Corporation (Azure Cognitive Services) | Speech-to-text / text-to-speech for JARIA voice (Azure Speech); Azure cloud hosting / infrastructure (Primary Region: Azure West Europe (Amsterdam) — EU, no transfer) | United States — Azure Speech East US region; processing originates from Azure West Europe (Amsterdam), the Primary Region | EU-US Data Privacy Framework + 2021 SCCs (Module 2); UK Addendum executed per customer; FDPIC supplemental measures (Switzerland) |
Speech services (Azure Speech) run in the Azure East US region; processing originates from Azure West Europe (Amsterdam), the Primary Region. Data Privacy Framework: OpenAI L.L.C. and Microsoft Corporation are certified under the EU-U.S. Data Privacy Framework (including the UK Extension and the Swiss-U.S. DPF); the U.S. data-protection addenda (OVR-SCH-003-US / OVR-SCH-003-US-EC) rely on that certification, supplemented by the 2021 SCCs (Module 2), a UK addendum executed per customer, and FDPIC supplemental measures for Swiss transfers. BYOK carve-out: OMEN text and content authoring operates via the customer’s own third-party API key (bring-your-own-key); that provider is engaged by the customer, is not an ORamaVR sub-processor, and is not listed in this register. Change log: every change to this register — the date and the sub-processor added, replaced or removed — is recorded in a change log published at the same URL. This register is the canonical, single operative sub-processor list for all ORamaVR agreements; DPA annexes and privacy documents reference it.
To confirm before publication Validate the live list with the CTO/DPO (services actually enabled per product, regions, and whether any further processors apply for enterprise on-premises deployments). |