Annex to the DPA: further processors

This annex lists the recipients in full; it reads without any further page. The version is stated above and is the one agreed at the time of contracting.

It is split by role. Part A names the processors under Art. 28 GDPR — this contract applies to them. Part B names recipients that act as their own controller for that part; the contract does not apply there, and it says so. The general overview “Service providers and recipients” on our website lists both in one table and is not a contractual annex.

A change or addition is announced at least 30 days in advance in text form and on the website. You may object; in that case there is a right to terminate as of the date of the change.

Where it says “to be confirmed”, the contracting entity is not yet evidenced by a signed contract but is the provider’s usual European contracting entity. It will be filled in before the contract is signed.

These recipients process on our behalf and on our instructions. This annex applies to them, and a contract under Art. 28 GDPR is in place for each.

• Purpose: Operation of the application, database, secret management, scheduling, load balancing and TLS
• Role: Processor (Art. 28 GDPR)
• Place of processing: EU – europe-west3 (Frankfurt)
• Contracting party: Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland
• Possible access from outside the EU: Administration and support by group companies outside the EU are technically possible
• Basis for the transfer: EU standard contractual clauses plus the EU–US adequacy decision

• Purpose: Analytics mirror for large-scale queries of your own; enabled per tenant
• Role: Processor (Art. 28 GDPR)
• Place of processing: EU – europe-west3 (Frankfurt)
• Contracting party: Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland
• Possible access from outside the EU: Administration and support by group companies outside the EU are technically possible
• Basis for the transfer: EU standard contractual clauses plus the EU–US adequacy decision

• Purpose: Language model behind the data assistant in the portal; receives the question, metrics and, where the question calls for it, individual conversions and journeys
• Role: Processor (Art. 28 GDPR)
• Place of processing: EU – europe-west3 (Frankfurt)
• Contracting party: Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland
• Possible access from outside the EU: Administration and support by group companies outside the EU are technically possible
• Basis for the transfer: EU standard contractual clauses plus the EU–US adequacy decision

• Purpose: Mailbox for support, contract and data-subject requests; holds no measurement data, but the correspondence about it
• Role: Processor (Art. 28 GDPR)
• Place of processing: Data region Europe, set by policy on 18 September 2026; exceptions for logs and cache and the migration status remain to be evidenced
• Contracting party: Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland
• Possible access from outside the EU: Administration and support by group companies outside the EU are technically possible
• Basis for the transfer: EU standard contractual clauses plus the EU–US adequacy decision

• Purpose: Sending system and notification e-mails, newsletter delivery, and receiving inbound support mail
• Role: Processor (Art. 28 GDPR)
• Place of processing: EU – France and Germany (OVH), Belgium (Google Cloud)
• Contracting party: Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany – under Brevo’s terms for customers based in Germany; parent company Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France
• Possible access from outside the EU: Customer support and maintenance by Brevo group companies in India, the US and Canada; content delivery network and web application firewall (Cloudflare), ticketing (Zendesk) and dashboards (Omni) by providers based in the US
• Basis for the transfer: EU standard contractual clauses with supplementary measures; for the US additionally the EU–US adequacy decision (Data Privacy Framework); for Canada the adequacy decision

• Purpose: Payment processing: billing address, payment method, invoice and subscription status. No measurement data
• Role: Dual role: processor for the contract data we pass on, own controller for the payment itself
• Place of processing: EU – Ireland
• Contracting party: Stripe Payments Europe, Limited, Dublin, Ireland; additionally Stripe Technology Europe, Limited, c/o A & L Goodbody, IFSC, North Wall Quay, Dublin 1, D01 H104, Ireland for regulated financial services
• Possible access from outside the EU: Group companies in the US as part of payment processing, fraud prevention and statutory duties
• Basis for the transfer: EU standard contractual clauses plus the EU–US adequacy decision

Appears in both parts: the role depends on which part of the processing is meant. The entry above names both.

They receive data but follow their own statutory duties, and to that extent not our instructions. A processing agreement is not the right paper for that part. They are listed here regardless, because a list naming only one half suggests there is no other.

• Stripe Payments Europe, Ltd.: Dual role: processor for the contract data we pass on, own controller for the payment itself

Advertising platforms are not processors. A transfer to them takes place only if the tenant explicitly switches on conversion forwarding — and then as processing in its own right, in joint or separate controllership depending on the platform.

For our own in-house analysis we use no tool that touches our customers’ data.