# Sub-Processor Notification Email Template (Bilko)

<div id="bkmrk-%E2%9A%A0%EF%B8%8F-statusmc%3A-%23100045" style="background-color: #FFF3CD; border-left: 4px solid #FFC107; padding: 16px; margin-bottom: 24px;">**⚠️ STATUS**  
**MC:** #100045 | **Date:** 2026-05-08  
**Draft Status:** Pending final legal review and translations (per Lexicon S1-S4)  
**Corrections Applied:** Org.nr 932 516 136 (corrected from hallucinated 933 534 262), Azure Sweden Central (corrected from Norway East)</div># Sub-Processor Notification Email Template

**Version:** 1.0 **Last Updated:** 2026-05-08 **Purpose:** Notify Bilko tenants of new sub-processors per GDPR Art. 28(4) **Language:** English (Norwegian translation pending)

---

## Email Template — English

**Subject:** Bilko Sub-Processor Update — Effective {{DATE\_PLUS\_30\_DAYS}}

---

**Dear {{TENANT\_NAME}},**

We are writing to inform you of changes to our sub-processor list for the Bilko accounting platform, in accordance with our Data Processing Agreement (DPA) and GDPR Article 28(4).

### New Sub-Processors

Effective **{{DATE\_PLUS\_30\_DAYS}}**, Bilko will use the following sub-processors for the **document archival feature**:

<table border="1" id="bkmrk-sub-processorpurpose"><tr><td>Sub-Processor</td><td>Purpose</td><td>Data Categories</td><td>Geographic Location</td><td>Safeguards</td></tr><tr><td>-----------------------------------------------------------------------------</td><td>---------------------------------------------</td><td>---------------------------------------------------------------------------</td><td>-------------------------------------------</td><td>------------------------------------------------------------------</td></tr><tr><td>**Cloudflare R2** (Cloudflare, Inc., USA)</td><td>Temporary staging for archive pipeline</td><td>Contract PDFs, invoices, care plans, incident reports, onboarding documents</td><td>EU region (eu-west storage bucket)</td><td>Standard Contractual Clauses (SCCs) per Cloudflare's published DPA</td></tr><tr><td>**ALAI Azure VM Paperless-ngx** (ALAI Holding AS, org.nr 932 516 136, Norway)</td><td>Long-term document archive at archive.alai.no</td><td>Same categories as above</td><td>EU/EEA (Microsoft Azure Sweden Central region)</td><td>ALAI DPA + Azure Standard Contractual Clauses</td></tr>### What This Means for You

- **If you have enabled the document archival feature** in Bilko, documents you mark for archival (contracts, invoices, care plans, incident reports, onboarding documents) will be processed through these sub-processors.
- **Data flow:** Documents are temporarily staged in Cloudflare R2 (typically &lt; 5 minutes), then transferred to ALAI's Paperless-ngx archive system hosted on Microsoft Azure (Sweden Central region).
- **Retention:** Financial documents are retained for 7 years; care-related documents for 25 years (per applicable accounting and care regulations).
- **Security:** All sub-processors are bound by Data Processing Agreements and Standard Contractual Clauses. Data is encrypted at rest (AES-256) and in transit (TLS 1.3).

### Your Right to Object

Under GDPR Article 28(4), you have the right to **object to the use of these sub-processors** within **30 days** of receiving this notice.

**If you object:**

- Send your objection in writing to **dpa@alai.no** by **{{DATE\_PLUS\_30\_DAYS}}**.
- We will work with you to find an alternative solution or, if not possible, allow you to terminate your Bilko subscription without penalty.

**If you do not object** by {{DATE\_PLUS\_30\_DAYS}}, this will constitute your consent to the use of these sub-processors. ### 30-Day Advance Notice

This notice is provided **30 days in advance** of the effective date ({{DATE\_PLUS\_30\_DAYS}}) in accordance with our DPA Section 3.4 and your Terms of Service Section 16.3.

### Questions or Concerns

If you have any questions about these sub-processors or our data processing practices, please contact:

- **Data Protection Officer:** Alem Bašić — alem@alai.no — +47 40 47 42 51
- **DPA Inquiries:** dpa@alai.no
- **General Support:** support@bilko.io

### Company Information

**ALAI Holding AS**

- Org.nr: 932 516 136
- Address: Tømmerrenna 1B, 2050 Jessheim, Norway
- Email: dpa@alai.no
- Website: https://bilko.io

We appreciate your trust in Bilko and remain committed to protecting your data in accordance with the highest standards of data protection law. Best regards,

**The Bilko Team**ALAI Holding AS

---

## Email Template — Norwegian (DRAFT — Translation Pending)

**Emne:** Bilko oppdatering av underleverandører — Trer i kraft {{DATE\_PLUS\_30\_DAYS}}

---

**Kjære {{TENANT\_NAME}},**

Vi skriver for å informere deg om endringer i vår liste over underleverandører for Bilko regnskapsplattform, i samsvar med vår databehandleravtale (DPA) og GDPR Artikkel 28(4).

### Nye underleverandører

Med virkning fra **{{DATE\_PLUS\_30\_DAYS}}** vil Bilko bruke følgende underleverandører for **dokumentarkivfunksjonen**:

<tr><td>Underleverandør</td><td>Formål</td><td>Datakategorier</td><td>Geografisk plassering</td><td>Sikkerhetstiltak</td></tr><tr><td>----------------------------------------------------------------------------</td><td>-------------------------------------</td><td>-------------------------------------------------------------------------------------</td><td>-------------------------------------------</td><td>-----------------------------------------------------------------</td></tr><tr><td>**Cloudflare R2** (Cloudflare, Inc., USA)</td><td>Midlertidig staging for arkivpipeline</td><td>Kontrakter (PDF), fakturaer, omsorgsplaner, hendelsesrapporter, onboarding-dokumenter</td><td>EU-region (eu-west lagringsbucket)</td><td>Standard Contractual Clauses (SCC) per Cloudflares publiserte DPA</td></tr><tr><td>**ALAI Azure VM Paperless-ngx** (ALAI Holding AS, org.nr 932 516 136, Norge)</td><td>Langtidsarkiv ved archive.alai.no</td><td>Samme kategorier som ovenfor</td><td>EU/EØS (Microsoft Azure Sweden Central-region)</td><td>ALAI DPA + Azure Standard Contractual Clauses</td></tr>### Hva betyr dette for deg?

- **Hvis du har aktivert dokumentarkivfunksjonen** i Bilko, vil dokumenter du markerer for arkivering (kontrakter, fakturaer, omsorgsplaner, hendelsesrapporter, onboarding-dokumenter) bli behandlet gjennom disse underleverandørene.
- **Dataflyt:** Dokumenter lagres midlertidig i Cloudflare R2 (typisk &lt; 5 minutter), deretter overført til ALAIs Paperless-ngx arkivsystem hostet på Microsoft Azure (Sverige Central-region).
- **Oppbevaring:** Finansielle dokumenter oppbevares i 7 år; omsorgsdokumenter i 25 år (per gjeldende regnskaps- og omsorgsreguleringer).
- **Sikkerhet:** Alle underleverandører er bundet av databehandleravtaler og Standard Contractual Clauses. Data krypteres ved lagring (AES-256) og i transitt (TLS 1.3).

### Din rett til å protestere

I henhold til GDPR Artikkel 28(4) har du rett til å **protestere mot bruken av disse underleverandørene** innen **30 dager** etter mottak av denne varslingen.

**Hvis du protesterer:**

- Send din protest skriftlig til **dpa@alai.no** innen **{{DATE\_PLUS\_30\_DAYS}}**.
- Vi vil samarbeide med deg for å finne en alternativ løsning eller, hvis ikke mulig, tillate deg å avslutte Bilko-abonnementet uten straff.

**Hvis du ikke protesterer** innen {{DATE\_PLUS\_30\_DAYS}}, vil dette utgjøre ditt samtykke til bruken av disse underleverandørene. ### 30-dagers forhåndsvarsel

Dette varslet gis **30 dager i forveien** for ikrafttredelsesdatoen ({{DATE\_PLUS\_30\_DAYS}}) i samsvar med vår DPA Seksjon 3.4 og dine Tjenestevilkår Seksjon 16.3.

### Spørsmål eller bekymringer

Hvis du har spørsmål om disse underleverandørene eller våre databehandlingspraksis, vennligst kontakt:

- **Personvernombud:** Alem Bašić — alem@alai.no — +47 40 47 42 51
- **DPA-henvendelser:** dpa@alai.no
- **Generell støtte:** support@bilko.io

### Selskapsinformasjon

**ALAI Holding AS**

- Org.nr: 932 516 136
- Adresse: Tømmerrenna 1B, 2050 Jessheim, Norge
- E-post: dpa@alai.no
- Nettside: https://bilko.io

Vi setter pris på din tillit til Bilko og forblir forpliktet til å beskytte dine data i samsvar med de høyeste standardene for databeskyttelseslov. Vennlig hilsen,

**Bilko-teamet**ALAI Holding AS

---

## Usage Instructions

### Placeholders to Replace

<tr><td>Placeholder</td><td>Description</td><td>Example</td></tr><tr><td>-----------------------</td><td>---------------------------------------</td><td>------------------------</td></tr><tr><td>`{{TENANT_NAME}}`</td><td>Organization name from Bilko database</td><td>"Acme Accounting d.o.o."</td></tr><tr><td>`{{DATE_PLUS_30_DAYS}}`</td><td>Effective date (30 days from send date)</td><td>"2026-06-07"</td></tr>### When to Send

This template should be sent:

- **30 days before** enabling the archive feature for existing tenants
- **30 days before** adding any new sub-processor to the archive pipeline
- **30 days before** replacing an existing sub-processor

### Sending Method

- **Email:** Send to organization owner's registered email address
- **In-app notification:** Display banner in Bilko UI with link to full notice
- **Audit log:** Record sending timestamp and recipient in Bilko's audit trail

### Follow-Up Actions

- **Track objections:** If tenant objects within 30 days, flag their account and escalate to ALAI DPO (alem@alai.no).
- **Auto-consent:** If no objection received by {{DATE\_PLUS\_30\_DAYS}}, record implicit consent in tenant's DPA compliance record.
- **Termination support:** If tenant objects and no alternative is available, process subscription cancellation per ToS Section 12.2 with data export provided.

--- ## Legal Review Notes

> ⚠️ **NORWEGIAN TRANSLATION:** This template is provided in English only. A professional Norwegian translation must be prepared before sending to Norwegian-speaking tenants or tenants in Norway.

> ⚠️ **SERBIAN/BOSNIAN/CROATIAN TRANSLATIONS:** For Balkan tenants, consider whether local-language versions are required under ZZPL (Serbia), ZZLP BiH (Bosnia &amp; Herzegovina), or GDPR (Croatia). Consult local legal counsel.

> ⚠️ **EFFECTIVE DATE PLACEHOLDER:** Ensure automated email system calculates {{DATE\_PLUS\_30\_DAYS}} dynamically from send date to guarantee 30-day notice period.

> ⚠️ **DPA REFERENCE:** Confirm that all Bilko tenant contracts include DPA Section 3.4 (sub-processor change notice clause) and ToS Section 16.3 (sub-processor disclosure) before sending this notice.

---

## Approval

<tr><td>Role</td><td>Name</td><td>Date</td></tr><tr><td>------------</td><td>------------------------------------</td><td>----------</td></tr><tr><td>Author</td><td>Lexicon (ALAI Legal &amp; Documentation)</td><td>2026-05-08</td></tr><tr><td>Legal Review</td><td>Pending</td></tr><tr><td>DPO Approval</td><td>Pending (Alem Bašić)</td></tr><tr><td>CEO Approval</td><td>Pending</td></tr></table>