Processors
Last updated: 8 November 2026. CIPRIAN-PAUL FRANDEȘ - CABINET DE AVOCAT (Frandeș Law) is the controller of the personal data it processes. The providers listed on this page process personal data on our behalf, as processors under Article 28 of Regulation (EU) 2016/679 (GDPR), on the basis of data processing agreements.
1. Providers used for this website
These providers are involved in running frandes.law, the chat assistant and the contact form. What each of them processes is explained in our Privacy Notice.
| Provider | Role | Where data is processed | Transfer safeguard |
|---|---|---|---|
| Cloud Forest Infrastructure SRL (RoLeaf) | Hosting of the website | Data centre in Buzău, Romania | No transfer outside the EEA |
| Hostinger | Hosting of our server for the chat, the contact form and the CUI lookup | Data centre in the EU | No transfer outside the EEA |
| Mistral AI SAS (Paris, France) | AI model for the chat assistant | EU | No transfer outside the EEA |
| Microsoft Ireland Operations Limited (Azure OpenAI Service) | Backup AI model for the chat assistant, used only if Mistral rejects a request | EU (EU Data Zone) | Processing in the EU; Standard Contractual Clauses; EU-US Data Privacy Framework (Microsoft Corporation) |
| Google Cloud EMEA Limited (Vertex AI) | Backup AI model for the chat assistant, used only if Mistral rejects a request | EU (Vertex AI EU multi-region) | Processing in the EU; Standard Contractual Clauses; EU-US Data Privacy Framework (Google LLC) |
| Resend, Inc. (USA) | Delivery of contact form messages and chat consultation requests to office@frandes.law | United States | EU-US Data Privacy Framework (Article 45 GDPR) |
| Microsoft Ireland Operations Limited (Microsoft 365) | The office@frandes.law mailbox | Microsoft data centres, according to our account configuration | Standard Contractual Clauses; EU-US Data Privacy Framework (Microsoft Corporation) |
2. Providers used in our work for clients
We use the following providers for our internal systems, including AI-assisted drafting, document review and legal research.
Hostinger
Role: hosting of the server that runs the firm's internal systems and databases.
Location: data centre in the EU.
Data: client files and working documents, pseudonymisation tables, encrypted backups.
Transfer safeguard: no transfer outside the EEA.
Microsoft Ireland Operations Limited
Role: Microsoft 365 (email, documents and calendar) and Azure OpenAI Service (AI models).
Location: Microsoft 365 according to our account configuration; Azure OpenAI in the EU (EU Data Zone).
Data: Microsoft 365 holds emails, documents and calendar entries. Azure OpenAI receives pseudonymised text (see section 3).
Transfer safeguard: Standard Contractual Clauses (Article 46(2)(c) GDPR); Microsoft Corporation is certified under the EU-US Data Privacy Framework.
Amazon Web Services EMEA SARL (Amazon Bedrock)
Role: AI models (Claude models developed by Anthropic, run by AWS through Amazon Bedrock).
Location: EU (Frankfurt region; requests may be routed to other AWS regions in the EU).
Data: pseudonymised text (see section 3). The data is processed by AWS and is not sent to Anthropic.
Transfer safeguard: processing in the EU; Standard Contractual Clauses; Amazon.com, Inc. is certified under the EU-US Data Privacy Framework.
Google Cloud EMEA Limited (Vertex AI)
Role: AI models (Gemini).
Location: EU (Vertex AI EU multi-region).
Data: pseudonymised text (see section 3).
Transfer safeguard: processing in the EU; Standard Contractual Clauses; Google LLC is certified under the EU-US Data Privacy Framework.
Mistral AI SAS
Role: AI models.
Location: France (EU).
Data: pseudonymised text (see section 3).
Transfer safeguard: no transfer outside the EEA.
Perplexity AI, Inc.
Role: web search for legal research in public sources.
Location: United States.
Data: search queries.
Transfer safeguard: Standard Contractual Clauses (Article 46(2)(c) GDPR) or the EU-US Data Privacy Framework, as provided in the provider's data processing terms.
Each processor must process the data only on our documented instructions, keep it confidential, apply appropriate technical and organisational security measures (Article 32 GDPR), help us respond to requests from data subjects, and delete or return the data when the service ends.
3. Pseudonymisation of client data
Before text from a client file is sent to an AI model, our system automatically replaces the names of individuals and personal identifiers, such as personal identification numbers (CNP), identity document numbers, bank account numbers (IBAN), addresses, phone numbers and email addresses, with placeholders. The table that links the placeholders to the real data is kept on the firm's server in the EU and is never sent to the providers. The AI model's answer is converted back to the real data on our server.
Pseudonymisation is automatic and may not catch every identifier. Pseudonymised data is still personal data under the GDPR (Recital 26), which is why the AI providers act under data processing agreements. Where a task requires it, the lawyer handling a matter may decide to send a text without pseudonymisation.
Information from public sources, such as legislation, case law and public registers, is not pseudonymised.
4. Changes to this list
We update this page when we add or replace a provider. Clients are informed of such changes as provided in their legal assistance agreement. Earlier versions of this page are available on request.
Contact
For any question about our processors or the safeguards that apply, write to office@frandes.law.