Annex to the DPA: further processors

This annex lists the recipients in full; it reads without any further page. The version is stated above and is the one agreed at the time of contracting.

It is split by role. Part A names the processors under Art. 28 GDPR — this contract applies to them. Part B names recipients that act as their own controller for that part; the contract does not apply there, and it says so. The general overview “Service providers and recipients” on our website lists both in one table and is not a contractual annex.

We announce a new or replaced direct processor at least 30 days before its engagement in text form and on the website; changes at further tiers are notified under section 7 of the agreement. You may object; section 7 governs what follows. How much notice a provider gives before a new further processor is stated for each entry below.

These recipients process on our behalf and on our instructions. This annex applies to them, and a contract under Art. 28 GDPR is in place for each.

• Purpose: Operation of the application, database, secret management, scheduling, load balancing and TLS
• Role: Processor (Art. 28 GDPR)
• Place of processing: EU – europe-west3 (Frankfurt)
• Contracting party: Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland
• Possible access from outside the EU: Administration and support by group companies outside the EU are technically possible
• Basis for the transfer: EU standard contractual clauses plus the EU–US adequacy decision
• Notice of new further processors according to the provider: at least 30 days before a new further processor processes data (Cloud Data Processing Addendum, section 11.4 a)

• Purpose: Analytics mirror for large-scale queries of your own; enabled per tenant
• Role: Processor (Art. 28 GDPR)
• Place of processing: EU – europe-west3 (Frankfurt)
• Contracting party: Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland
• Possible access from outside the EU: Administration and support by group companies outside the EU are technically possible
• Basis for the transfer: EU standard contractual clauses plus the EU–US adequacy decision
• Notice of new further processors according to the provider: at least 30 days before a new further processor processes data (Cloud Data Processing Addendum, section 11.4 a)

• Purpose: Language model behind the data assistant in the portal; receives the question, metrics and, where the question calls for it, individual conversions and journeys
• Role: Processor (Art. 28 GDPR)
• Place of processing: EU – europe-west3 (Frankfurt)
• Contracting party: Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland
• Possible access from outside the EU: Administration and support by group companies outside the EU are technically possible
• Basis for the transfer: EU standard contractual clauses plus the EU–US adequacy decision
• Notice of new further processors according to the provider: at least 30 days before a new further processor processes data (Cloud Data Processing Addendum, section 11.4 a)

• Purpose: Mailbox for support, contract and data-subject requests; measurement data only where it appears in that correspondence
• Role: Processor (Art. 28 GDPR)
• Place of processing: Data region Europe, set by policy on 18 September 2026; exceptions for logs and cache and the migration status remain to be evidenced
• Contracting party: Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland
• Possible access from outside the EU: Administration and support by group companies outside the EU are technically possible
• Basis for the transfer: EU standard contractual clauses plus the EU–US adequacy decision
• Notice of new further processors according to the provider: at least 30 days before a new further processor processes data (Data Processing Amendment for Google Workspace, section 11.4 a)

• Purpose: Sending system and notification e-mails, newsletter delivery, and receiving inbound support mail
• Role: Processor (Art. 28 GDPR)
• Place of processing: EU – France and Germany (OVH), Belgium (Google Cloud)
• Contracting party: Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany – under Brevo’s terms for customers based in Germany; parent company Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France
• Possible access from outside the EU: Customer support and maintenance by Brevo group companies in India, the US and Canada; content delivery network and web application firewall (Cloudflare), ticketing (Zendesk) and dashboards (Omni) by providers based in the US
• Basis for the transfer: EU standard contractual clauses with supplementary measures; for the US additionally the EU–US adequacy decision (Data Privacy Framework); for Canada the adequacy decision
• Scope on the client’s behalf: On behalf of our customers: support e-mails insofar as they contain data from the engagement, and system e-mails with measurement results, in particular weekly and monthly reports with metrics and a CSV attachment; aggregated metrics too can allow conclusions about individual persons where case numbers are small. This applies until support e-mails and these system e-mails are sent via Google Workspace and no data from the engagement actually reaches Brevo any more; only then is Brevo removed from this annex. The newsletter and system e-mails without measurement results are sent via Brevo as our own processing
• Notice of new further processors according to the provider: before engagement, without a fixed period (data protection agreement, section 7.3). The DPA rule for sub-processors without secured notice therefore applies: from receipt of a notice, support e-mails go via Google Workspace, and system e-mails with measurement results are sent via Google Workspace or suspended until then

• Purpose: Payment processing: billing address, payment method, invoice and subscription status. No measurement data
• Role: Dual role: processor for the contract data we pass on, own controller for the payment itself
• Place of processing: EU – Ireland
• Contracting party: Stripe Payments Europe, Limited, Dublin, Ireland; additionally Stripe Technology Europe, Limited, c/o A & L Goodbody, IFSC, North Wall Quay, Dublin 1, D01 H104, Ireland for regulated financial services
• Possible access from outside the EU: Group companies in the US as part of payment processing, fraud prevention and statutory duties
• Basis for the transfer: EU standard contractual clauses plus the EU–US adequacy decision

Appears in both parts: the role depends on which part of the processing is meant. The entry above names both.

They receive data but follow their own statutory duties, and to that extent not our instructions. A processing agreement is not the right paper for that part. They are listed here regardless, because a list naming only one half suggests there is no other.

• Stripe Payments Europe, Ltd.: Dual role: processor for the contract data we pass on, own controller for the payment itself

Advertising platforms are not processors. A transfer to them takes place only if the tenant explicitly switches on conversion forwarding — and then as processing in its own right, in joint or separate controllership depending on the platform.

For our own in-house analysis we use no tool that touches our customers’ data.