Sub-Processor Notification Email Template (Bilko)
⚠️ DRAFT — pending final legal sign-off and translations (per Lexicon notes). MC #100045. 2026-05-08. Canonical-facts verified by John post-Lexicon (org.nr 932 516 136, Azure Sweden Central).
Sub-Processor Notification Email Template (Bilko)
Version: 1.0
Last Updated: 2026-05-08
Purpose: Notify Bilko tenants of new sub-processors per GDPR Art. 28(4)
Language: English (Norwegian translation below)
Email Template — English
Subject: Bilko Sub-Processor Update — Effective {{DATE_PLUS_30_DAYS}}
Dear {{TENANT_NAME}},
We are writing to inform you of changes to our sub-processor list for the Bilko accounting platform, in accordance with our Data Processing Agreement (DPA) and GDPR Article 28(4).
New Sub-Processors
Effective {{DATE_PLUS_30_DAYS}}, Bilko will use the following sub-processors for the document archival feature:
| Sub-Processor | Purpose | Data Categories | Geographic Location | Safeguards |
|---|---|---|---|---|
| Cloudflare R2 (Cloudflare, Inc., USA) | Temporary staging for archive pipeline | Contract PDFs, invoices, care plans, incident reports, onboarding documents | EU region (eu-west storage bucket) | Standard Contractual Clauses (SCCs) per Cloudflare's published DPA |
| ALAI Azure VM Paperless-ngx (ALAI Holding AS, org.nr 932 516 136, Norway) | Long-term document archive at archive.alai.no | Same categories as above | EU/EEA (Microsoft Azure Sweden Central region) | ALAI DPA + Azure Standard Contractual Clauses |
What This Means for You
- If you have enabled the document archival feature in Bilko, documents you mark for archival (contracts, invoices, care plans, incident reports, onboarding documents) will be processed through these sub-processors.
- Data flow: Documents are temporarily staged in Cloudflare R2 (typically < 5 minutes), then transferred to ALAI's Paperless-ngx archive system hosted on Microsoft Azure (Sweden Central region).
- Retention: Financial documents are retained for 7 years; care-related documents for 25 years (per applicable accounting and care regulations).
- Security: All sub-processors are bound by Data Processing Agreements and Standard Contractual Clauses. Data is encrypted at rest (AES-256) and in transit (TLS 1.3).
Your Right to Object
Under GDPR Article 28(4), you have the right to object to the use of these sub-processors within 30 days of receiving this notice.
If you object:
- Send your objection in writing to [email protected] by {{DATE_PLUS_30_DAYS}}.
- We will work with you to find an alternative solution or, if not possible, allow you to terminate your Bilko subscription without penalty.
If you do not object by {{DATE_PLUS_30_DAYS}}, this will constitute your consent to the use of these sub-processors.
30-Day Advance Notice
This notice is provided 30 days in advance of the effective date ({{DATE_PLUS_30_DAYS}}) in accordance with our DPA Section 3.4 and your Terms of Service Section 16.3.
Questions or Concerns
If you have any questions about these sub-processors or our data processing practices, please contact:
- Data Protection Officer: Alem Bašić — [email protected] — +47 40 47 42 51
- DPA Inquiries: [email protected]
- General Support: [email protected]
Company Information
ALAI Holding AS
- Org.nr: 932 516 136
- Address: Tømmerrenna 1B, 2050 Jessheim, Norway
- Email: [email protected]
- Website: https://bilko.io
We appreciate your trust in Bilko and remain committed to protecting your data in accordance with the highest standards of data protection law.
Best regards,
The Bilko Team
ALAI Holding AS
Email Template — Norwegian (Norsk oversettelse — UTKAST)
Emne: Bilko oppdatering av underleverandører — Trer i kraft {{DATE_PLUS_30_DAYS}}
Kjære {{TENANT_NAME}},
Vi skriver for å informere deg om endringer i vår liste over underleverandører for Bilko regnskapsplattform, i samsvar med vår databehandleravtale (DPA) og GDPR Artikkel 28(4).
Nye underleverandører
Med virkning fra {{DATE_PLUS_30_DAYS}} vil Bilko bruke følgende underleverandører for dokumentarkivfunksjonen:
| Underleverandør | Formål | Datakategorier | Geografisk plassering | Sikkerhetstiltak |
|---|---|---|---|---|
| Cloudflare R2 (Cloudflare, Inc., USA) | Midlertidig staging for arkivpipeline | Kontrakter (PDF), fakturaer, omsorgsplaner, hendelsesrapporter, onboarding-dokumenter | EU-region (eu-west lagringsbucket) | Standard Contractual Clauses (SCC) per Cloudflares publiserte DPA |
| ALAI Azure VM Paperless-ngx (ALAI Holding AS, org.nr 932 516 136, Norge) | Langtidsarkiv ved archive.alai.no | Samme kategorier som ovenfor | EU/EØS (Microsoft Azure Sweden Central-region) | ALAI DPA + Azure Standard Contractual Clauses |
Selskapsinfo: ALAI Holding AS (org.nr 932 516 136) • [email protected] • https://bilko.io
Usage Instructions
Placeholders to Replace
| Placeholder | Description | Example |
|---|---|---|
{{TENANT_NAME}} | Organization name from Bilko database | "Acme Accounting d.o.o." |
{{DATE_PLUS_30_DAYS}} | Effective date (30 days from send date) | "2026-06-07" |
When to Send
This template should be sent:
- 30 days before enabling the archive feature for existing tenants
- 30 days before adding any new sub-processor to the archive pipeline
- 30 days before replacing an existing sub-processor
Sending Method
- Email: Send to organization owner's registered email address
- In-app notification: Display banner in Bilko UI with link to full notice
- Audit log: Record sending timestamp and recipient in Bilko's audit trail
Company: ALAI Holding AS (org.nr 932 516 136)
Contact: [email protected] | [email protected]