Subprocessors

Courtesy translation. In case of any discrepancy, the Spanish version at `/legal` prevails.

Last updated: 20 July 2026

01One-line summary

To provide the Camaleonic Survey service, Camaleonic ads 2020 S.L. (commercial brand: Camaleonic Survey) relies on a small number of technology providers. This page is the public, up-to-date list of those providers: what role they play, where they are located, and whether they process data belonging to the people who respond to surveys.

021. Audience and purpose of this page

When a customer (a company, an SME, a university, a brand, a public body... any organization that contracts the service) creates a survey on Camaleonic Survey, that customer is the data controller for the respondents' answers. Camaleonic Survey acts as data processor: it processes that data on behalf of the customer and following its instructions, for the purposes the customer (as controller) determines.

The complete chain is as follows: the respondent (data subject) provides their answers to the customer that created the survey (the controller); the customer relies on Camaleonic Survey (the processor); and Camaleonic Survey relies, in turn, on the sub-processors on this list (providers of infrastructure, artificial intelligence and machine translation). Each link is contractually bound to the previous one with equivalent data protection obligations.

The General Data Protection Regulation requires that a data processor not engage another processor (a sub-processor) without the prior authorization of the controller, and that it keep the controller informed of any change to that list (Article 28, paragraphs 2 and 4, of the GDPR, Regulation (EU) 2016/679). This page fulfills that function: it is the list of sub-processors that the customer, as controller, authorizes upon accepting the Data Processing Terms.

Important note on roles. Camaleonic Survey operates under a hybrid model:

- It is the processor for the processing of respondents' answers (it processes on behalf of the customer).

- It is the controller only for the processing of the customer's account and billing data (registration, subscription, billing) and of the aggregated and anonymized analytics it produces from use of the service.

This list covers the sub-processors involved in the Survey service. Some of them (for example, the payment provider) are involved only in customer account data and do not process respondent data.

The aggregated analytics that Camaleonic produces and, where applicable, commercializes are built exclusively on previously aggregated and anonymized results, in a way that never allows a natural person to be identified or an individual response to be revealed. Respondents' personal data is never sold or commercialized under any circumstances. To the extent that such analytics cease to operate on identifiable personal data, they fall outside the scope of the GDPR; for as long as they retain the status of personal data, Camaleonic processes them as controller, on the legal basis of its legitimate interest in improving and commercializing the service (Article 6.1.f of the GDPR), separately from the processing it carries out as processor on behalf of the customer.

032. The list of sub-processors

Below are the providers currently in use. The "Does it process respondent data?" column indicates whether that provider processes data belonging to the people who respond to surveys (answers, browsing metadata, invitation email, etc.), as opposed to providers that are involved only in the customer's account. The "Is it AI?" column identifies providers that perform artificial intelligence inference or machine translation.

Transparency notice on data location

A distinction should be drawn between where data is stored and where it may occasionally be processed. The primary storage of surveys and responses takes place in the European Union: the main database (Supabase) is hosted in the EU. The application operates on AWS compute infrastructure. When the customer uses artificial intelligence or machine translation features, the strictly necessary content is transmitted on a one-off basis to the corresponding providers (Groq, Anthropic, translation engines), which may process it in the United States or other countries; that one-off processing does not alter the place of storage. Stripe (payments) operates from the United States and Cloudflare has global reach. Any involvement outside the EU is subject to the GDPR's international transfer regime (Chapter V, Articles 44 to 49); the specific mechanism for each transfer is indicated in the table.

Unless an adequacy framework is indicated in the table, international transfers are based on the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914), together with any supplementary measures that may be applicable following the corresponding transfer impact assessment.

043. Artificial intelligence

Camaleonic Survey incorporates active artificial intelligence features to support the customer: assistance in creating surveys, generation of summaries, quality and sentiment analysis of responses, multi-survey analysis, brand palette extraction from an image, and machine translation. These features are executed at the customer's request and only process data when the customer decides to use them; new capabilities are activated gradually, as they become available.

The inference providers are:

• Groq (United States), the main provider of the service's AI features. The associated international transfer is based on the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914), together with any applicable supplementary measures, and is subject to a commitment not to use the customer's data to train models.
• Anthropic (United States), for specific features: multi-survey analysis and brand palette extraction from an image. The transfer is likewise based on the Standard Contractual Clauses.
• MyMemory and/or LibreTranslate, machine translation engines: when the customer uses translation, the survey text is sent to the engine for translation. This processing only takes place if the customer activates the feature.

Processing via AI is carried out on behalf of the customer and under its responsibility as data controller, on the legal basis that the customer determines for the corresponding purpose. Camaleonic applies the safeguards required under Regulation (EU) 2024/1689 (Artificial Intelligence Act) depending on the specific use, and reports any material change to the providers or to the conditions of this processing in accordance with the procedure set out in Section 6. The outputs generated by AI and the content provided by the customer are the property of the customer, under the terms set out in Section 8.

054. Data protection measures

Regardless of the provider, the following technical and organizational measures apply:

• Encryption in transit (TLS) and encryption at rest for stored data.
• Isolation by organization through row-level security (RLS): one customer's data is not accessible from another organization.
• Pseudonymization of network and device identifiers: the IP address, user agent and device ID are stored as a hash.

Clarification: this is pseudonymization, not anonymization. It is not claimed that the process is irreversible or that the data becomes anonymous; it continues to be considered personal data and is protected as such.

• In surveys configured as anonymous, no direct identifiers of the respondent are collected, although pseudonymized technical identifiers (hashed IP, browser and device) may be processed for security and anti-abuse purposes; those hashes remain pseudonymized personal data and are protected as such.
• Retention configurable per survey with a daily automatic purge, logical deletion of responses, and definitive automatic purge after 30 days.

Data breach notification

In the event of a breach of personal data security affecting data processed on behalf of the customer, Camaleonic, as processor, will notify the customer (data controller) without undue delay and, at the latest, within 48 hours of becoming aware of the incident, providing the information reasonably available so that the controller can fulfill its own notification obligations under Articles 33 and 34 of the GDPR. In particular, notification to the supervisory authority (AEPD) within the maximum period of 72 hours is the responsibility of the party acting as data controller.

065. Respondent data that may be processed

Depending on how the customer configures each survey, respondent data may include:

• Answers to the questions, response language, duration and timestamps (always).
• The respondent's email, when the survey requires it for an optional purpose determined by the customer (for example: sending them the results, marketing communications if they consent, or entry into a prize draw).
• Demographic data (age, gender, city), when requested by the survey.

The controller (the customer) decides what data is collected in each survey and for what purpose; Camaleonic Survey, as processor, processes it in accordance with that configuration and the customer's instructions.

Determining the legal basis for each purpose is the responsibility of the customer as data controller. For optional or secondary purposes (for example, marketing communications or prize draws), the customer must obtain, where applicable, the respondent's specific, informed and unambiguous consent (Articles 6.1.a and 7 of the GDPR), as well as comply with the obligations arising from the regulations on information society services and commercial electronic communications (LSSI-CE, Ley 34/2002 [Spanish Law 34/2002 on Information Society Services and Electronic Commerce], and Directive 2002/58/EC on privacy and electronic communications).

076. Notification of changes to this list

This list may change as the service evolves. When it is planned to add or replace a sub-processor, this will be communicated at least 30 calendar days before the change takes effect, so that the customer (as data controller) can exercise its right to object before the new sub-processor begins processing data (Article 28.2 of the GDPR).

Notification will be given by means of communication to the customer's account administrator and/or an updated posting on this page. If the customer, for reasonable and documented data-protection reasons, objects to the new sub-processor within the notice period, the parties will make good-faith efforts to find an alternative solution; if none is reached, the customer may terminate the affected service without penalty. To also receive these notices by email, write to [email protected].

087. Data retention

Data processed on behalf of the customer is retained for the duration of the contract and, after its termination, is deleted or returned at the customer's choice in accordance with the Data Processing Terms, unless it must be retained for the legally required period to address liabilities arising from the processing. During the term, each survey may have its own configured retention period, after which the responses are purged automatically through a daily process; in addition, deleted responses are definitively purged 30 days after their logical deletion, in accordance with Section 4. Account and billing data is retained for the period legally required under commercial, accounting and tax regulations.

098. Service, liability and ownership of results

Service availability. Camaleonic applies reasonable measures to maintain the availability and performance of the service, but does not guarantee uninterrupted or error-free availability. The service may be affected by maintenance work, updates or incidents involving the providers listed on this page.

Limitation of liability. Camaleonic's liability is limited, to the maximum extent permitted by Spanish law, to actually proven direct damages, excluding indirect damages, loss of profit and loss of data or opportunity, without prejudice to liabilities that, under the law, cannot be validly limited or excluded (including, among others, those arising from willful misconduct or from mandatory data protection and consumer protection regulations).

Ownership of AI outputs and customer content. Content provided by the customer, respondents' answers processed on the customer's behalf, and outputs generated by the artificial intelligence features belong entirely to the customer. Camaleonic does not claim any intellectual or industrial property right over such outputs or over the customer's content, without prejudice to Camaleonic's rights over the platform, its software, and the aggregated and anonymized analytics, in accordance with intellectual property regulations (Real Decreto Legislativo 1/1996 [Royal Legislative Decree 1/1996, approving the recast text of the Spanish Intellectual Property Law]).

109. Governing law and jurisdiction

This list of sub-processors and the data processing relationship to which it refers are governed by Spanish law and by applicable European Union law. For the resolution of any dispute, the parties submit to the courts of the registered office of Camaleonic ads 2020 S.L., except where mandatory law provides otherwise, in particular applicable consumer protection law.

1110. Contact

For any question regarding this list of sub-processors or the processing of data:

Camaleonic ads 2020 S.L., a Spanish company (commercial brand: Camaleonic Survey) General and privacy contact: [email protected]

Informational document. It does not constitute individualized legal advice.