General Terms · Article 11.2.7 · Personal data
Sub-processors
The companies DINAO relies on to perform the Services, as provided for in Article 11.2.7 “Sub-processors” of the General Terms.
Purpose of this list
This list forms part of Article 11.2.7 “Sub-processors” of the General Terms and Conditions of Sale. It identifies the sub-processors that DINAO may engage to perform the Services. Any addition of a sub-processor, as well as any bringing into service of an authorised sub-processor, is published here at least thirty (30) days before it takes effect; during this period, the Customer may raise a reasoned objection and, if the objection is not resolved, terminate the service concerned without penalty. Where a risk to the security or continuity of the Services so requires, DINAO may replace a sub-processor without notice: it then informs the Customer without delay, and the objection period runs from that notification.
List updated on 1 November 2026. History of changes at the bottom of the page.
Hosting, domain names and operated services
These sub-processors process, on behalf of DINAO, data that the Customer entrusts to it.
| Sub-processor | Service provided | Data concerned | Location | Safeguards | Status |
|---|---|---|---|---|---|
| Free Pro iliad group | Server hosting — Marseille data centre | Data hosted by the Customer | France (European Union) | No transfer | In service |
| Euclyde DataCenters nLighten group | Server hosting — Sophia-Antipolis data centre | Data hosted by the Customer | France (European Union) | No transfer | In service |
| Microsoft | Microsoft 365 offer, where subscribed | Data entrusted to the Microsoft 365 service | European Union and outside the European Union | Transfer subject to safeguards (Chapter V of the GDPR, Article 11.2.8 of the General Terms and Conditions of Sale) | In service |
| OVH SAS | Registration of domain names; OVH hosting, where subscribed | Contact details of the domain name registrant; data of the subscribed hosting | France (European Union) | No transfer | In service |
| Gandi SAS | Registration of domain names | Contact details of the domain name registrant | France (European Union) | No transfer | In service |
| eNom Tucows group | Issuance of SSL certificates | Domain name and contact details of the certificate request | United States | Transfer subject to safeguards (Chapter V of the GDPR, Article 11.2.8 of the General Terms and Conditions of Sale) | In service |
Artificial intelligence models
Under the conditions of Article 5 bis of the General Terms: models run by DINAO on its own servers take priority; a third-party provider receives only pseudonymised data, does not use them to train its models and limits their retention period. An "authorised" provider is not used to date: its bringing into service is announced on this page thirty (30) days in advance, together with its retention period. The "DINAO" row, which does not designate a third party, is included for information.
| Sub-processor | Service provided | Data concerned | Location | Safeguards | Status |
|---|---|---|---|---|---|
| Anthropic | Operations and support assistant (Claude) | Pseudonymised data (Article 5 bis.2) | United States | No training of models on the data; retention 30 days, up to 2 years for an exchange flagged for security reasons | In service |
| Mistral AI | Language models (API) | Pseudonymised data, if brought into service | France (European Union) | Retention specified when brought into service | Authorised, not used to date |
| OpenAI | Language models (API) | Pseudonymised data, if brought into service | United States | Transfer subject to safeguards (Chapter V of the GDPR); retention specified when brought into service | Authorised, not used to date |
| Language models (Gemini, Vertex AI) | Pseudonymised data, if brought into service | European Union or United States, depending on the region selected | Region and retention specified when brought into service | Authorised, not used to date | |
| DINAO | Models run on DINAO's computing servers, on its premises | Data necessary for the operation (Article 5 bis.1) | France — DINAO's premises | No third party, no transfer; retention identical to that of support requests | In service |
Occasional support access
Software publishers to which DINAO grants access for the duration of a support intervention. Access is time-limited, protected by two-factor authentication and closed at the end of the intervention.
| Sub-processor | Service provided | Data concerned | Location | Safeguards | Status |
|---|---|---|---|---|---|
| ModulesGarden | Publisher of the management platform modules (ordering, DNS, Plesk, Proxmox) | Data of the management platform, for the duration of the intervention | Poland (European Union) | No transfer | Occasional access |
| RS Studio | Publisher of the customer area theme | Data of the management platform, for the duration of the intervention | Poland (European Union) | No transfer | Occasional access |
History of changes
| Date | Change |
|---|---|
| 1 November 2026 | The data processing agreement becomes Article 11.2 of the General Terms; this list forms part of it under Article 11.2.7. No sub-processor added, removed or brought into service. |
| 11 October 2026 | Removal of AFNIC, announced on 5 October 2026 and never brought into service in that capacity: as the registry of .fr, it receives the contact details of a domain name registrant in order to maintain its own directory, as controller, and not on behalf of DINAO. It is presented in the Special Terms "Domain names" and in the privacy policy. |
| 5 October 2026 | First publication of the list, which replaces the table in the annex of 4 October 2026. Additions: eNom (SSL certificates); providers of artificial intelligence models — AI run by DINAO and Anthropic in service, Mistral AI, OpenAI and Google authorised; occasional support access for ModulesGarden and RS Studio. |
| 5 October 2026 | Announced addition of AFNIC, registry of .fr, of which DINAO will become a direct registrar. Taking effect on 4 November 2026 at the earliest. |
