Subprocessors

A Subprocessor is a third party engaged by Donna to process Customer Data in connection with the Donna platform, where that processing is carried out under Donna's instructions and on Donna's behalf. The term has the meaning given to it in the Donna Data Processing Addendum (the “DPA”), and this page operates as Annex 3 to the DPA for the purposes of listing approved Subprocessors.

Donna commits to maintaining this list in a current and accurate state. We add a Subprocessor to this list before that Subprocessor begins processing Customer Data. We remove a Subprocessor from this list when it ceases to process Customer Data on our behalf. The list is versioned and dated, and prior versions are available on request.

Each entry below describes the Subprocessor's legal entity, its role, the processing activities it performs, the geographical locations from which it carries out those activities, and the relevant third-party certifications it holds. Every Subprocessor listed here processes Customer Data in Australia. The list is limited to direct Subprocessors. Some of our direct Subprocessors will themselves engage further sub-sub-processors, and the public security and trust pages of those direct Subprocessors disclose their onward arrangements.

Donna provides Customers with at least 30 days' advance notice before a new Subprocessor begins processing Customer Data, before an existing Subprocessor takes on a materially new processing activity, and before a Subprocessor is removed in circumstances that affect a Customer service component. Notice is given by updating this page and by email to Customers who have asked to be notified. Customers and prospective Customers can ask to be added to the change-notification list by writing to privacy@bydonna.ai.

A Customer may object to the addition of a new Subprocessor on reasonable data-protection grounds within the 30-day notice period by writing to privacy@bydonna.ai. On receiving an objection, Donna and the Customer will work together in good faith to resolve the concern, including by exploring an alternative Subprocessor, an alternative configuration, or additional safeguards. If, despite good-faith engagement, Donna and the Customer have not reached a resolution within the 30-day notice period, the Customer may, as its sole and exclusive remedy, terminate the affected service component on written notice. No fees are payable in respect of the affected service component for any period after termination, and where the Customer has prepaid for that component Donna will refund the unused portion on a pro-rata basis.

For the avoidance of doubt, where Donna replaces a Subprocessor with another Subprocessor in the same role on an emergency basis (for example, in response to a security incident affecting the existing Subprocessor or a sudden discontinuation of the existing Subprocessor's service), Donna may make the replacement before the 30-day notice period has run, provided that we notify Customers as soon as reasonably practicable and that the replacement Subprocessor offers a level of protection that is at least equivalent to the one being replaced.

Donna runs the Donna platform on Microsoft Azure, with sign-in through Auth0. Tier 1 covers the hyperscale infrastructure on which Customer Data is hosted at rest and the underlying platform services that support compute, storage, networking, identity and observability. Customer Data is processed and stored in Australia East (Sydney), with Australia Southeast (Melbourne) as the paired region for disaster recovery. Donna does not move Customer Data outside Australia.

Where the Customer has enabled customer-managed keys (an Enterprise-tier feature), the keys are held in Azure Key Vault in Australia. Diagnostic and platform telemetry produced by Azure is processed in the same Australian region as the resource that emits it.

Donna's AI features are powered by foundation models hosted by the providers listed below, and all inference runs in Australia. Inference is the only processing activity these providers perform on Customer Data. Neither provider is permitted to use Customer Inputs or Outputs to train or fine-tune foundation models. Claude models are served through Amazon Bedrock, so Customer Data goes to Amazon Web Services in Sydney and is not sent to Anthropic.

Microsoft's contractual commitments for Azure OpenAI are that Customer Inputs and Outputs are not used to train or improve any foundation model, and that abuse-monitoring data is retained for 30 days unless Microsoft's “no abuse monitoring” amendment is in place. Donna requests the no-abuse-monitoring amendment for legal-services tenants on Azure OpenAI so that Customer Inputs and Outputs are not retained for abuse-monitoring purposes.

Amazon's commitments for Amazon Bedrock are that Customer Inputs and Outputs are not used to train any foundation model, are not shared with the model developer (including Anthropic), and are processed in the AWS region Donna selects, which is Asia Pacific (Sydney).

Customer Data stays in Australia. The Donna Data Transfers Addendum sets this out in full. This section summarises how it applies to the Subprocessors listed above.

Questions about this page, requests to subscribe to or unsubscribe from change notifications, subscription and unsubscription requests, and objections to a proposed Subprocessor change should be directed to Donna's privacy team at privacy@bydonna.ai.

For matters relating to the underlying processing of Personal Information, please refer to the Donna Privacy Policy. For the contractual framework that governs Donna's engagement of Subprocessors, please refer to the Data Processing Addendum and the Data Transfers Addendum. For the technical and organisational measures that protect Customer Data across all Subprocessors listed above, please refer to the Donna Security page.