Sub-Processor Notification Email Template (Bilko)
⚠️ STATUS
MC: #100045 | Date: 2026-05-08
Draft Status: Pending final legal review and translations (per Lexicon S1-S4)
Corrections Applied: Org.nr 932 516 136 (corrected from hallucinated 933 534 262), Azure Sweden Central (corrected from Norway East)
MC: #100045 | Date: 2026-05-08
Draft Status: Pending final legal review and translations (per Lexicon S1-S4)
Corrections Applied: Org.nr 932 516 136 (corrected from hallucinated 933 534 262), Azure Sweden Central (corrected from Norway East)
Sub-Processor Notification Email Template
Version: 1.0 Last Updated: 2026-05-08 Purpose: Notify Bilko tenants of new sub-processors per GDPR Art. 28(4) Language: English (Norwegian translation pending)
Email Template — English
Subject: Bilko Sub-Processor Update — Effective {{DATE_PLUS_30_DAYS}}
Dear {{TENANT_NAME}},
We are writing to inform you of changes to our sub-processor list for the Bilko accounting platform, in accordance with our Data Processing Agreement (DPA) and GDPR Article 28(4).
New Sub-Processors
Effective {{DATE_PLUS_30_DAYS}}, Bilko will use the following sub-processors for the document archival feature:
| Sub-Processor | Purpose | Data Categories | Geographic Location | Safeguards |
| ----------------------------------------------------------------------------- | --------------------------------------------- | --------------------------------------------------------------------------- | ------------------------------------------- | ------------------------------------------------------------------ |
| Cloudflare R2 (Cloudflare, Inc., USA) | Temporary staging for archive pipeline | Contract PDFs, invoices, care plans, incident reports, onboarding documents | EU region (eu-west storage bucket) | Standard Contractual Clauses (SCCs) per Cloudflare's published DPA |
| ALAI Azure VM Paperless-ngx (ALAI Holding AS, org.nr 932 516 136, Norway) | Long-term document archive at archive.alai.no | Same categories as above | EU/EEA (Microsoft Azure Sweden Central region) | ALAI DPA + Azure Standard Contractual Clauses |
What This Means for You
- If you have enabled the document archival feature in Bilko, documents you mark for archival (contracts, invoices, care plans, incident reports, onboarding documents) will be processed through these sub-processors.
- Data flow: Documents are temporarily staged in Cloudflare R2 (typically < 5 minutes), then transferred to ALAI's Paperless-ngx archive system hosted on Microsoft Azure (Sweden Central region).
- Retention: Financial documents are retained for 7 years; care-related documents for 25 years (per applicable accounting and care regulations).
- Security: All sub-processors are bound by Data Processing Agreements and Standard Contractual Clauses. Data is encrypted at rest (AES-256) and in transit (TLS 1.3).
Your Right to Object
Under GDPR Article 28(4), you have the right to object to the use of these sub-processors within 30 days of receiving this notice.
If you object:
- Send your objection in writing to [email protected] by {{DATE_PLUS_30_DAYS}}.
- We will work with you to find an alternative solution or, if not possible, allow you to terminate your Bilko subscription without penalty.
30-Day Advance Notice
This notice is provided 30 days in advance of the effective date ({{DATE_PLUS_30_DAYS}}) in accordance with our DPA Section 3.4 and your Terms of Service Section 16.3.
Questions or Concerns
If you have any questions about these sub-processors or our data processing practices, please contact:
- Data Protection Officer: Alem Bašić — [email protected] — +47 40 47 42 51
- DPA Inquiries: [email protected]
- General Support: [email protected]
Company Information
ALAI Holding AS
- Org.nr: 932 516 136
- Address: Tømmerrenna 1B, 2050 Jessheim, Norway
- Email: [email protected]
- Website: https://bilko.io
Best regards,
The Bilko Team ALAI Holding AS
Email Template — Norwegian (DRAFT — Translation Pending)
Emne: Bilko oppdatering av underleverandører — Trer i kraft {{DATE_PLUS_30_DAYS}}
Kjære {{TENANT_NAME}},
Vi skriver for å informere deg om endringer i vår liste over underleverandører for Bilko regnskapsplattform, i samsvar med vår databehandleravtale (DPA) og GDPR Artikkel 28(4).
Nye underleverandører
Med virkning fra {{DATE_PLUS_30_DAYS}} vil Bilko bruke følgende underleverandører for dokumentarkivfunksjonen:
Hva betyr dette for deg?
- Hvis du har aktivert dokumentarkivfunksjonen i Bilko, vil dokumenter du markerer for arkivering (kontrakter, fakturaer, omsorgsplaner, hendelsesrapporter, onboarding-dokumenter) bli behandlet gjennom disse underleverandørene.
- Dataflyt: Dokumenter lagres midlertidig i Cloudflare R2 (typisk < 5 minutter), deretter overført til ALAIs Paperless-ngx arkivsystem hostet på Microsoft Azure (Norge Øst-region).
- Oppbevaring: Finansielle dokumenter oppbevares i 7 år; omsorgsdokumenter i 25 år (per gjeldende regnskaps- og omsorgsreguleringer).
- Sikkerhet: Alle underleverandører er bundet av databehandleravtaler og Standard Contractual Clauses. Data krypteres ved lagring (AES-256) og i transitt (TLS 1.3).
Din rett til å protestere
I henhold til GDPR Artikkel 28(4) har du rett til å protestere mot bruken av disse underleverandørene innen 30 dager etter mottak av denne varslingen.
Hvis du protesterer:
- Send din protest skriftlig til [email protected] innen {{DATE_PLUS_30_DAYS}}.
- Vi vil samarbeide med deg for å finne en alternativ løsning eller, hvis ikke mulig, tillate deg å avslutte Bilko-abonnementet uten straff.
30-dagers forhåndsvarsel
Dette varslet gis 30 dager i forveien for ikrafttredelsesdatoen ({{DATE_PLUS_30_DAYS}}) i samsvar med vår DPA Seksjon 3.4 og dine Tjenestevilkår Seksjon 16.3.
Spørsmål eller bekymringer
Hvis du har spørsmål om disse underleverandørene eller våre databehandlingspraksis, vennligst kontakt:
- Personvernombud: Alem Bašić — [email protected] — +47 40 47 42 51
- DPA-henvendelser: [email protected]
- Generell støtte: [email protected]
Selskapsinformasjon
ALAI Holding AS
- Org.nr: 932 516 136
- Adresse: Tømmerrenna 1B, 2050 Jessheim, Norge
- E-post: [email protected]
- Nettside: https://bilko.io
Vennlig hilsen,
Bilko-teamet ALAI Holding AS
Usage Instructions
Placeholders to Replace
{{TENANT_NAME}}{{DATE_PLUS_30_DAYS}}When to Send
This template should be sent:
- 30 days before enabling the archive feature for existing tenants
- 30 days before adding any new sub-processor to the archive pipeline
- 30 days before replacing an existing sub-processor
Sending Method
- Email: Send to organization owner's registered email address
- In-app notification: Display banner in Bilko UI with link to full notice
- Audit log: Record sending timestamp and recipient in Bilko's audit trail
Follow-Up Actions
- Track objections: If tenant objects within 30 days, flag their account and escalate to ALAI DPO ([email protected]).
- Auto-consent: If no objection received by {{DATE_PLUS_30_DAYS}}, record implicit consent in tenant's DPA compliance record.
- Termination support: If tenant objects and no alternative is available, process subscription cancellation per ToS Section 12.2 with data export provided.
Legal Review Notes
⚠️ NORWEGIAN TRANSLATION: This template is provided in English only. A professional Norwegian translation must be prepared before sending to Norwegian-speaking tenants or tenants in Norway.
⚠️ SERBIAN/BOSNIAN/CROATIAN TRANSLATIONS: For Balkan tenants, consider whether local-language versions are required under ZZPL (Serbia), ZZLP BiH (Bosnia & Herzegovina), or GDPR (Croatia). Consult local legal counsel.
⚠️ EFFECTIVE DATE PLACEHOLDER: Ensure automated email system calculates {{DATE_PLUS_30_DAYS}} dynamically from send date to guarantee 30-day notice period.
⚠️ DPA REFERENCE: Confirm that all Bilko tenant contracts include DPA Section 3.4 (sub-processor change notice clause) and ToS Section 16.3 (sub-processor disclosure) before sending this notice.