# Sub-Processor Notification Email Template (Bilko)

⚠️ **DRAFT** — pending final legal sign-off and translations (per Lexicon notes). MC #100045. 2026-05-08. Canonical-facts verified by John post-Lexicon (org.nr 932 516 136, Azure Sweden Central).

---

## Sub-Processor Notification Email Template (Bilko)

**Version:** 1.0  
**Last Updated:** 2026-05-08  
**Purpose:** Notify Bilko tenants of new sub-processors per GDPR Art. 28(4)  
**Language:** English (Norwegian translation below)

---

### Email Template — English

**Subject:** Bilko Sub-Processor Update — Effective {{DATE\_PLUS\_30\_DAYS}}

---

**Dear {{TENANT\_NAME}},**

We are writing to inform you of changes to our sub-processor list for the Bilko accounting platform, in accordance with our Data Processing Agreement (DPA) and GDPR Article 28(4).

#### New Sub-Processors

Effective **{{DATE\_PLUS\_30\_DAYS}}**, Bilko will use the following sub-processors for the **document archival feature**:

<table id="bkmrk-sub-processor-purpos"><thead><tr><th>Sub-Processor</th><th>Purpose</th><th>Data Categories</th><th>Geographic Location</th><th>Safeguards</th></tr></thead><tbody><tr><td>**Cloudflare R2** (Cloudflare, Inc., USA)</td><td>Temporary staging for archive pipeline</td><td>Contract PDFs, invoices, care plans, incident reports, onboarding documents</td><td>EU region (eu-west storage bucket)</td><td>Standard Contractual Clauses (SCCs) per Cloudflare's published DPA</td></tr><tr><td>**ALAI Azure VM Paperless-ngx** (ALAI Holding AS, org.nr 932 516 136, Norway)</td><td>Long-term document archive at archive.alai.no</td><td>Same categories as above</td><td>EU/EEA (Microsoft Azure Sweden Central region)</td><td>ALAI DPA + Azure Standard Contractual Clauses</td></tr></tbody></table>

#### What This Means for You

- **If you have enabled the document archival feature** in Bilko, documents you mark for archival (contracts, invoices, care plans, incident reports, onboarding documents) will be processed through these sub-processors.
- **Data flow:** Documents are temporarily staged in Cloudflare R2 (typically &lt; 5 minutes), then transferred to ALAI's Paperless-ngx archive system hosted on Microsoft Azure (Sweden Central region).
- **Retention:** Financial documents are retained for 7 years; care-related documents for 25 years (per applicable accounting and care regulations).
- **Security:** All sub-processors are bound by Data Processing Agreements and Standard Contractual Clauses. Data is encrypted at rest (AES-256) and in transit (TLS 1.3).

#### Your Right to Object

Under GDPR Article 28(4), you have the right to **object to the use of these sub-processors** within **30 days** of receiving this notice.

**If you object:**

1. Send your objection in writing to **dpa@alai.no** by **{{DATE\_PLUS\_30\_DAYS}}**.
2. We will work with you to find an alternative solution or, if not possible, allow you to terminate your Bilko subscription without penalty.

**If you do not object** by {{DATE\_PLUS\_30\_DAYS}}, this will constitute your consent to the use of these sub-processors.

#### 30-Day Advance Notice

This notice is provided **30 days in advance** of the effective date ({{DATE\_PLUS\_30\_DAYS}}) in accordance with our DPA Section 3.4 and your Terms of Service Section 16.3.

#### Questions or Concerns

If you have any questions about these sub-processors or our data processing practices, please contact:

- **Data Protection Officer:** Alem Bašić — alem@alai.no — +47 40 47 42 51
- **DPA Inquiries:** dpa@alai.no
- **General Support:** support@bilko.io

#### Company Information

**ALAI Holding AS**

- Org.nr: 932 516 136
- Address: Tømmerrenna 1B, 2050 Jessheim, Norway
- Email: dpa@alai.no
- Website: https://bilko.io

We appreciate your trust in Bilko and remain committed to protecting your data in accordance with the highest standards of data protection law.

Best regards,  
**The Bilko Team**  
ALAI Holding AS

---

### Email Template — Norwegian (Norsk oversettelse — UTKAST)

**Emne:** Bilko oppdatering av underleverandører — Trer i kraft {{DATE\_PLUS\_30\_DAYS}}

**Kjære {{TENANT\_NAME}},**

Vi skriver for å informere deg om endringer i vår liste over underleverandører for Bilko regnskapsplattform, i samsvar med vår databehandleravtale (DPA) og GDPR Artikkel 28(4).

#### Nye underleverandører

Med virkning fra **{{DATE\_PLUS\_30\_DAYS}}** vil Bilko bruke følgende underleverandører for **dokumentarkivfunksjonen**:

<table id="bkmrk-underleverand%C3%B8r-form"><thead><tr><th>Underleverandør</th><th>Formål</th><th>Datakategorier</th><th>Geografisk plassering</th><th>Sikkerhetstiltak</th></tr></thead><tbody><tr><td>**Cloudflare R2** (Cloudflare, Inc., USA)</td><td>Midlertidig staging for arkivpipeline</td><td>Kontrakter (PDF), fakturaer, omsorgsplaner, hendelsesrapporter, onboarding-dokumenter</td><td>EU-region (eu-west lagringsbucket)</td><td>Standard Contractual Clauses (SCC) per Cloudflares publiserte DPA</td></tr><tr><td>**ALAI Azure VM Paperless-ngx** (ALAI Holding AS, org.nr 932 516 136, Norge)</td><td>Langtidsarkiv ved archive.alai.no</td><td>Samme kategorier som ovenfor</td><td>EU/EØS (Microsoft Azure Sweden Central-region)</td><td>ALAI DPA + Azure Standard Contractual Clauses</td></tr></tbody></table>

**Selskapsinfo:** ALAI Holding AS (org.nr 932 516 136) • dpa@alai.no • https://bilko.io

---

### Usage Instructions

#### Placeholders to Replace

<table id="bkmrk-placeholderdescripti"><thead><tr><th>Placeholder</th><th>Description</th><th>Example</th></tr></thead><tbody><tr><td>`{{TENANT_NAME}}`</td><td>Organization name from Bilko database</td><td>"Acme Accounting d.o.o."</td></tr><tr><td>`{{DATE_PLUS_30_DAYS}}`</td><td>Effective date (30 days from send date)</td><td>"2026-06-07"</td></tr></tbody></table>

#### When to Send

This template should be sent:

1. **30 days before** enabling the archive feature for existing tenants
2. **30 days before** adding any new sub-processor to the archive pipeline
3. **30 days before** replacing an existing sub-processor

#### Sending Method

- **Email:** Send to organization owner's registered email address
- **In-app notification:** Display banner in Bilko UI with link to full notice
- **Audit log:** Record sending timestamp and recipient in Bilko's audit trail

---

**Company:** ALAI Holding AS (org.nr 932 516 136)  
**Contact:** dpa@alai.no | support@bilko.io