Reference
What a sub-processor notice clause obliges you to do
You signed a data processing agreement with an AI vendor. Somewhere in it is a clause about sub-processors: the vendor may add one, it will tell you, and you have a set period to object. Every quote on this page comes from an agreement we read on the date shown.
The period runs from their notice, not from your discovery
This is the term that decides whether the clause is manageable. The window opens when the vendor publishes or notifies. A week spent not knowing is a week of the window.
If, within five (5) calendar days after such notice, Customer notifies Vercel in writing that Customer objects to Vercel's appointment of a new Subprocessor based on reasonable data protection concerns, the parties will discuss such concerns in good faith and whether they can be resolved.
Vercel — https://vercel.com/legal/dpa · read Aug 31, 2026 · snapshot 39299ad58649
Customer may object in writing to ClickHouse's appointment of a new Sub-Processor by notifying ClickHouse promptly in writing within ten (10) calendar days of notice of the change.
Langfuse — https://langfuse.com/dpa · read Aug 31, 2026 · snapshot f9debf41aeb4
The shortest window we can quote is 5 business days. Every window we hold is listed separately.
In some agreements, saying nothing is agreement
A missed window is not a deferred decision. At least one agreement in this record states what happens when the period passes without an objection.
The Customer may only object in writing to Mistral AI's appointment of a new Subprocessor within ten (10) days of such notice by providing a written objection to privacy@mistral.ai, provided that such objection is based on reasonable grounds relating to the Applicable Data Protection Law, otherwise such new Subprocessor will be deemed approved.
Mistral AI — https://legal.mistral.ai/terms/data-processing-addendum · read Aug 31, 2026 · snapshot 8778ed476e03
“We will notify you” can mean several different things
The clauses in this record do not agree on what notice is. Some send an email. Some publish to a page. Some send an email only if you subscribed first.
(c) Anyscale shall notify Customer if it engages a new Subprocessor at least ten (10) days prior to any such change if Customer opts-in to receive such notifications in the manner made available on the Subprocessor List.
Anyscale — https://anyscale.com/dpa · read Aug 31, 2026 · snapshot 9f39bea95b71
At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, AssemblyAI will add such third party to the List and notify Customer via the email address subscribed to receive notifications of New Subprocessors as described herein.
AssemblyAI — https://assemblyai.com/legal/data-processing-addendum · read Aug 31, 2026 · snapshot 41df076a0966
Where notice is a page rather than a message, nothing arrives in anyone’s inbox. The page changes and the window opens.
An objection has to be written, and it has to have grounds
The clauses set conditions on the objection itself. It is in writing, it goes to a named address, and it rests on stated data-protection grounds rather than preference.
Customer may object to the Processing of Customer’s Personal Data by the New Sub-Processor, for reasonable and explained grounds, by providing a written objection to [email protected] within 5 business days following Gong’s written notice to Customer of the intended engagement with the New Sub-Processor.
Gong — https://gong.io/legal/data-processing-addendum · read Aug 31, 2026 · snapshot cab59af09f81
What follows an objection is usually a discussion, not a veto. The agreements we hold describe good-faith discussion, and some allow termination if the concern cannot be resolved.
Business days and calendar days are not the same clause
Both appear in this record. Gong states 5 business days, which spans a longer stretch of the calendar than the same number of days. A tracker that stores “days” and drops the unit will compute the wrong date.
Customer may object to the Processing of Customer’s Personal Data by the New Sub-Processor, for reasonable and explained grounds, by providing a written objection to [email protected] within 5 business days following Gong’s written notice to Customer of the intended engagement with the New Sub-Processor.
Gong — https://gong.io/legal/data-processing-addendum · read Aug 31, 2026 · snapshot cab59af09f81
What the clause asks of you, in order
- Know which vendors process your customers’ data, and which of their agreements carry this clause.
- Find out when one of their lists changes. Where notice is a published page, this means re-reading the page.
- Compare the new list against the last one, and identify what was added or removed.
- Decide whether to object, inside the window, in writing, on data-protection grounds.
- Tell your own customers, if your agreements with them carry a matching clause. Their window usually starts when you notify them.
Steps two and three are what Xither does. How the record is kept.
What this page is not
It is not legal advice. It quotes published agreements on the dates shown; your negotiated contract may say something else, and it governs.
Written by Xither. Every vendor quotation is generated from the record at the time this page is served, with its source URL, read date and snapshot hash.