About this list
Walter uses the third-party subprocessors listed below to provide its services. Each subprocessor processes personal data only on Walter's instructions and only for the purposes listed. Each is bound by written data protection terms at least as protective as those in our Data Processing Addendum. Where personal data is transferred outside the European Economic Area, we rely on an adequacy decision, the EU–US Data Privacy Framework, or Standard Contractual Clauses.
Last updated: 24 September 2026
Infrastructure and service providers
| Subprocessor | Purpose | Personal data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Google Cloud EMEA Ltd (Google Cloud Platform, including Gemini via Vertex AI) | Hosting, storage and compute for the Walter platform; AI-assisted document processing, such as extracting data from quotes, invoices and delivery documents | All customer data held in the Walter platform, including uploaded documents | EU, europe-west1 (Belgium) | Hosted in the EU; SCCs for any support access from outside the EU |
| Google Cloud EMEA Ltd (Google Workspace) | Business email, documents and internal collaboration | Business communications and contact details | EU / United States | SCCs / Data Privacy Framework |
| Anthropic, PBC | Internal productivity and software development tools used by Walter staff | Limited customer data, only where needed for support or development tasks | United States | SCCs / Data Privacy Framework |
| Twilio Inc. (SendGrid) | Transactional email: notifications, order updates, account emails | Name, email address, email content | United States | SCCs / Data Privacy Framework |
| HubSpot Ireland Ltd | CRM, sales and customer communication | Business contact details: name, email, phone, company, role | EU | Hosted in the EU |
| Stripe Payments Europe Ltd | Payment processing and invoicing for customers contracting with BONATECH PARTNERS SL | Billing contact details, payment and transaction data | EU / United States | SCCs / Data Privacy Framework |
| Stripe, Inc. | Payment processing and invoicing for customers contracting with Walter Technologies LLC | Billing contact details, payment and transaction data | United States | SCCs / Data Privacy Framework |
| NinjaOne, LLC | Device management and monitoring, for customers who take it through Walter | Device details, assigned user name and email | EU | Hosted in the EU; SCCs for any support access from outside the EU |
Fulfilment suppliers
Walter sources and resells equipment through a network of hardware suppliers and distributors, selected per order based on product availability and delivery destination.
- Purpose: sourcing and delivering ordered equipment to recipients
- Personal data shared: recipient name, delivery address, phone number and order details only
- Location: worldwide, depending on delivery destination
- Safeguards: suppliers are bound by data protection terms, including Standard Contractual Clauses where required, and must pass equivalent obligations on to the logistics providers they use
The supplier fulfilling each order is shown on that order in the Walter platform.
Endpoint security providers
For customers who take endpoint security (EDR) through Walter, it is provided by third-party endpoint security providers integrated with our device management partner, NinjaOne.
- Purpose: detecting and responding to threats on the customer's devices, including managed detection and response where the customer's plan includes it
- Personal data processed: device details, security events and telemetry from the device, and the name and email of the device's assigned user
- Location: Europe
- Safeguards: hosted in Europe; provided and managed entirely through NinjaOne, our device management partner. Walter does not contract with or manage the endpoint security provider directly
AI and model training
Walter does not use customer data to train AI models. Our AI providers process customer data under commercial terms that prohibit them from using it to train their models.
Changes to this list
Walter will notify customers before adding a new subprocessor or a new category of fulfilment supplier. Customers may object on reasonable data protection grounds within 30 days of notice.