{
  "version": "3.0",
  "updated_at": "2026-08-30",
  "publisher": {
    "legal_name": "Almustaqbal Alfadh for digital marketing Establishment",
    "trading_as": "FTH Digital Marketing",
    "cr": "1009092617",
    "unified_establishment_no": "7041553525",
    "contact": "privacy@fth.marketing",
    "contact_services": "privacy@fth.sa"
  },
  "scope": "Sub-processors engaged by FTH to process client personal data in the provision of its four services: recovery of suspended Business Profiles, Business Profile restructuring and reporting, ongoing Business Profile management, and the FTH Maps platform.",
  "categories": {
    "all_services": "Engaged for every client across all four FTH services.",
    "managed_services": "Engaged only where the client takes one of FTH's three managed services: recovery of suspended Business Profiles, Business Profile restructuring and reporting, or ongoing Business Profile management."
  },
  "subprocessors": [
    {
      "category": "all_services",
      "name": "Contabo GmbH",
      "role": "Infrastructure hosting: application servers, database, object storage holding encrypted backups, and the mail server.",
      "legal_entity": "Contabo GmbH",
      "entity_country": "Germany",
      "processing_location": "Platform, database, encrypted backups and the mail server within the European Union",
      "instrument": "Data processing agreements under Article 28 of the GDPR, concluded 2026-08-24, 2026-08-29 and 2026-08-30, covering all FTH subscriptions with the provider: compute, object storage and the mail server. They bind the processor under Article 28 GDPR; transfer of client data outside the European Union requires FTH's prior consent, and FTH selected server locations within the European Union for these subscriptions (panel region: EU for all three subscriptions).",
      "date_listed": "2026-08-23"
    },
    {
      "category": "all_services",
      "name": "Cloudflare, Inc.",
      "role": "Edge network in front of the platform and the GBP MCP server used for the three managed services: DNS, denial-of-service protection and TLS termination. Traffic transits the edge; no client data is stored there.",
      "legal_entity": "Cloudflare, Inc.",
      "entity_country": "United States",
      "processing_location": "Global edge network",
      "instrument": "Cloudflare Customer DPA v6.4 (2026-04-03).",
      "instrument_references": ["https://www.cloudflare.com/gdpr/subprocessors/"],
      "date_listed": "2026-08-23"
    },
    {
      "category": "managed_services",
      "name": "Anthropic PBC",
      "role": "AI-assisted analysis within FTH managed services",
      "legal_entity": "Anthropic PBC",
      "entity_country": "United States",
      "processing_location": "United States",
      "instrument": "No data processing agreement is relied on for this channel. Content reaches the provider de-identified, so client personal data is not placed in it.",
      "date_listed": "2026-08-23"
    }
  ],
  "not_subprocessors": [
    {
      "category": "Providers the client contracts directly",
      "detail": "Where a client supplies its own AI API key, or configures its own receiving endpoint such as a CRM, that provider is engaged under the client's own contract and is not an FTH sub-processor."
    },
    {
      "category": "Tools used for FTH's own software development",
      "detail": "Software FTH uses to build and maintain the platform, which does not process client personal data in the running service, is not a sub-processor."
    },
    {
      "category": "Google",
      "detail": "Google is the source platform, accessed under the client's own documented and revocable authorisation, and is not an FTH sub-processor."
    },
    {
      "category": "Consumer AI subscriptions",
      "detail": "Consumer AI subscriptions are never used as a channel for client personal data."
    }
  ],
  "change_policy": "Additions or replacements are notified to clients in advance, with a right to object under the applicable agreement.",
  "changelog": [
    {
      "version": "3.0",
      "date": "2026-08-30",
      "summary": "First publication of this register. It replaces the former reference to an annex of a separate data processing agreement. The version number matches the Data Protection Specifications it accompanies."
    }
  ],
  "notice_model": {
    "mechanism": "publication",
    "objection_window_days": 30,
    "detail": "A new or replacement sub-processor appears on this page. Publication is the notice, and FTH may engage the sub-processor from the date it is listed. A client may object on reasonable data protection grounds within thirty days of publication. FTH works with the client to address the objection, including by not using that sub-processor for the client's workspace where it supports an optional feature. Where the sub-processor is part of the platform's infrastructure and the objection cannot be resolved, the client may terminate the service that relies on it. Termination is limited to that service and does not affect the client's other services with FTH. An objection does not suspend the engagement. The sub-processors listed when this register was first published were already engaged at that date, and publication disclosed them."
  },
  "scope_note": "This register lists FTH's direct sub-processors. A sub-processor's own sub-contractors are governed by that sub-processor's agreement and published list, and a change there does not change this register."
}