FundOS — Sub-processor Policy & Register

Effective Date: 01-Oct-2025 • Version: 1.0
Register Contact: privacy@klub.ai

A. Policy

A1. Purpose

This Policy defines how Klub AI Solutions Ltd (“we”, “us”) appoints and manages Sub-processors supporting the FundOS platform.

A2. Minimum Controls

Sub-processors must implement security and privacy measures equivalent to those in our Data Processing Addendum (DPA), including:

Confidentiality and personnel access control
Encryption in transit and at rest
Access logging and monitoring
Incident reporting and notification
Assistance with data-subject rights and DPIAs
Secure deletion or return of data on contract termination
Compliance with Reg-10 requirements for Autonomous Systems (where applicable)

A3. Contractual Terms

All Sub-processors are bound by written agreements covering:

Processing instructions and lawful purposes
Confidentiality and security requirements
Cooperation on privacy rights, DPIAs, and AI/Reg-10 controls
Restrictions on onward processing
Right to audit or review controls
Return or deletion of data upon exit

A4. Change Management

We maintain this Sub-processor Register and provide advance notice of material additions or replacements, allowing Customers to raise reasonable data-protection objections.

A5. Responsibility

Klub AI Solutions Ltd remains responsible for Sub-processors’ performance and compliance with this Policy.

A6. Sub-processor Register

#	Category	Provider	Purpose	Data Processed	Regions
6.1	Cloud Infrastructure	[CloudCo]	Compute / Storage / Networking	Customer Content; telemetry; logs	UAE (me-central-1)
6.2	Email / Ingestion	[MailIngest]	Inbound parsing and relay	File metadata; contact data	[region]
6.3	Analytics / Monitoring	[ObservabilityCo]	Logs, metrics, and alerting	Pseudonymised telemetry	[region]
6.4	Support Tooling	[SupportDesk]	Ticketing and support communications	Contact info; ticket content	[region]
6.5	Backup / DR	[BackupCo]	Encrypted backups and restores	Encrypted snapshots	[region]
6.6	Error Tracking	[ErrorTrackCo]	Exception tracking	Pseudonymised error events	[region]

Last Updated: [date]