Sub-processors
Dated September 13, 2026.
Non-binding English translation. The German version prevails.
| Sub-processor | Registered location / purpose | Third-country transfer mechanism |
|---|---|---|
| Hetzner Online GmbH | Germany – cloud hosting and infrastructure | Processing in the EEA |
| seven communications GmbH & Co. KG / seven.io | Germany – SMS dispatch | Processing in the EEA |
| Cloudflare, Inc. or the relevant Cloudflare contracting entity | USA / international – web infrastructure, security, content delivery | Adequacy decision / DPF where necessary; supplementary SCCs |
| AC PM LLC / ActiveCampaign / Postmark | USA – delivery of transactional emails | EU-US Data Privacy Framework; additional safeguards where necessary |
| OpenAI Ireland Ltd. | Ireland – AI-assisted text and document processing, where included in the scope of services | EEA contracting entity; intra-group transfers to third countries only under Chapter V GDPR |
| Apify Technologies s.r.o. | Czech Republic – retrieval of publicly available business and review data | Processing in the EEA |
This register corresponds to Annex 3 of the Data Processing Agreement.
The Processor informs the Controller in accordance with Section 9 of the Data Processing Agreement before engaging or replacing a sub-processor.
Distinction: not a sub-processor under this agreement
To the extent that the following service provider processes data exclusively for the Processor’s own purposes or processes data outside the processing covered by this agreement, it is not classified as a sub-processor under this agreement:
- Stripe Payments Europe, Limited, insofar as only payment processing between the Processor and the Controller is concerned.
If the actual processing changes and becomes connected with personal data of the Controller, the data protection classification must be reviewed again before processing begins.