Service providers and data sources
The companies that run parts of Attestia for OOMZEE Oy (Captila), and the registries and providers Attestia checks businesses against. We tell enterprises using Attestia in the portal or by email before we add a new service provider that processes personal data on our behalf.
1. Service providers that process data on our behalf
They act only on our instructions under data processing agreements (Article 28 GDPR). Attestia's sign-in service, database and document storage run on our own servers at these providers; no other company runs them for us.
| Provider | What for | Where | Basis for transfer | Status |
|---|---|---|---|---|
| IONOS | Servers, storage and backups of the Attestia platform | European Union | Data processing agreement | In use |
| Microsoft (Microsoft Ireland Operations Ltd) | Email sent by the platform (Microsoft 365, EU Data Boundary) | European Union | Data processing agreement | In use |
2. Registries we check against
We send what a check needs, such as a business ID, company name, VAT number, LEI, brand name or domain. The answers are public registry information about the business, which may include the names and roles of its board members and managers.
| Provider | What for | Where | Basis for transfer | Status |
|---|---|---|---|---|
| Finnish Patent and Registration Office (PRH, YTJ) | Finnish companies: registry details and signing rights | Finland | Public authority | In use |
| European Commission (VIES) | EU VAT numbers | European Union | Public authority | In use |
| European Union Intellectual Property Office (EUIPO) | EU trademarks for brands | European Union | EU agency | In use |
| Global Legal Entity Identifier Foundation (GLEIF) | LEI codes | Switzerland | Adequacy decision | In use |
| Brønnøysundregistrene | Norwegian companies | Norway (EEA) | EEA | In use |
| UK Companies House | UK companies and officers | United Kingdom | Adequacy decision | In use |
| Domain registries (RDAP) | Who holds a website domain; only the domain name is sent | Worldwide | No personal data sent | In use |
3. Credit reference agencies and verification providers
Used only where Attestia has a contract with them and has switched them on, and only for a business in their country or region. Before switching on a provider outside the EU or EEA, we confirm the basis for the transfer shown here.
| Provider | What for | Where | Basis for transfer | Status |
|---|---|---|---|---|
| Suomen Asiakastieto (Enento) | Credit reports, Finland | Finland | EU | When contracted |
| Experian UK, Equifax Ltd | Credit reports, United Kingdom | United Kingdom | Adequacy decision | When contracted |
| Creditsafe | Credit reports, Europe | United Kingdom and EU | Adequacy decision | When contracted |
| Other European credit reference agencies (UC, Experian Nordics, Creditreform, CRIF, SCHUFA, KSV1870, Altares, Ellisphere, Vision-net, Informa D&B, Cerved, CRIBIS, BIG InfoMonitor, KRD, OPTEN, Creditinfo, ICAP CRIF, Coface, Allianz Trade, modefinance) | Credit reports in their countries | European Union, EEA or Switzerland | EU, EEA or adequacy decision | When contracted |
| Dun & Bradstreet | Company identity and credit data, worldwide | United States | Data Privacy Framework or standard contractual clauses | When contracted |
| AECB, SIMAH, Qatar Credit Bureau | Credit reports for businesses in the UAE, Saudi Arabia and Qatar | UAE, Saudi Arabia, Qatar | Standard contractual clauses | When contracted |
| OpenSanctions | Sanctions lists, for company names | Germany | EU | When switched on |
| Didit | Business verification | European Union | EU | When switched on |
| Twilio | Phone number lookup and one-time codes to the contact person's phone | United States | Data Privacy Framework | When switched on |
| Mobile operators (CAMARA, Open Gateway) | Number verification | Operator's country | Agreed per operator | Planned |
| PRH Virre | Finnish signing rights by API | Finland | Public authority | When contracted |
4. Questions
Write to privacy@captila.com. How we handle personal data is described in the privacy notice.