This is the only list of ORamaVR’s sub-processors for customer personal data under the Data Processing Agreement (Exhibit C, OVR-SCH-003, Section 5.5 and Annex 3). ORamaVR gives at least 30 days’ notice before adding or replacing a sub-processor. Providers that process only ORamaVR’s own data (for example website analytics and CRM) are described in the Privacy Policy instead.
| Sub-processor | Service | Customer data | Where | Transfer safeguard |
|---|---|---|---|---|
| Microsoft Ireland Operations Limited (Ireland); Azure Speech processed by Microsoft Corporation (United States) | Cloud hosting of the VTC Platform and Creator tenants; Azure Speech for JARIA speech-to-text and text-to-speech | Hosting: all customer platform data. Speech: voice audio and transcripts, processed in real time; the Speech resource stores no audio or transcripts | Hosting: Azure West Europe (Netherlands, EU). Speech: Azure East US (United States) | Hosting: none (EU). Speech: EU–US Data Privacy Framework, Swiss–US DPF and UK extension (Microsoft Corporation certified; checked 28 Sep 2026), plus the standard contractual clauses in Microsoft’s Data Protection Addendum |
| OpenAI Ireland Ltd (Ireland), processing through OpenAI OpCo, LLC (United States) | Language-model inference for JARIA; image generation for OMEN | JARIA: transcripts, serialised scene state, IFU references. OMEN: image prompts and generated images. Requests carry only a technical request ID and the user’s words — no name, e-mail address or account ID | United States | Standard contractual clauses (Module Three) in OpenAI’s Data Processing Addendum, under which the data goes to OpenAI OpCo, LLC in the United States, with the Swiss adaptations and UK addendum. OpenAI is not certified under the DPF. Not used for model training. OpenAI may keep request data for up to 30 days for abuse monitoring under its standard API terms |
| The Authorized Channel Partner that sold the customer’s subscription (for that customer only) | Onboarding users, managing the tenant, distributing licences, first-line support (DPA §5.6) | Customer administrator and user account data in the Org-Admin Portal | The partner’s country | Adequacy or standard contractual clauses under the partner agreement |
Where a customer uses its own account with an AI provider, through its own key (“bring your own key”) — for example for OMEN text features — that provider works for the customer, not for ORamaVR, and is not listed here.
| Sub-processor | Service | Customer data | Where | Safeguard | Effective |
|---|---|---|---|---|---|
| ORamaVR Single Member S.A. (Greece) — ORamaVR affiliate | Development, operations and customer support | Customer platform data, only as a task requires, through ORamaVR’s systems | Greece (EU); data stays in the Primary Region | None (EU); intra-group data processing agreement | 30 days after notice |
ORamaVR plans to move Azure Speech to an EU region and to run JARIA and OMEN inference on Microsoft Azure OpenAI in the EU, so that customer data of EU, Swiss and other non-US customers is processed in the EU only. OpenAI would then be removed. Each step will be announced here with at least 30 days’ notice before it takes effect.
| Date | Change |
|---|---|
| v2.0, 22 October 2026 | ORamaVR Single Member S.A. (Greece) added, effective 30 days after the publication notice. Authorized Channel Partner row added. Data categories stated for each provider. DPF status and OpenAI abuse-monitoring retention stated. Planned EU move announced. |
| September 2026 (v1.0) | First publication: Microsoft (Azure hosting and Azure Speech) and OpenAI. |
Questions or objections: support@oramavr.com.