Annex to the DPA: further processors

This annex lists the recipients in full; it reads without any further page. The version is stated above and is the one agreed at the time of contracting.

It is split by role. Part A names the processors under Art. 28 GDPR — this contract applies to them. Part B names recipients that act as their own controller for that part; the contract does not apply there, and it says so. The general overview “Service providers and recipients” on our website lists both in one table and is not a contractual annex.

We announce a new or replaced direct processor at least 30 days before its engagement in text form and on the website; changes at further tiers are notified under section 7 of the agreement. You may object; section 7 governs what follows. How much notice a provider gives before a new further processor is stated for each entry below.

These recipients process on our behalf and on our instructions. This annex applies to them, and a contract under Art. 28 GDPR is in place for each.

• Purpose: Operation of the application, database, secret management, scheduling, load balancing and TLS
• Role: Processor (Art. 28 GDPR)
• Place of processing: EU – europe-west3 (Frankfurt)
• Contracting party: Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland
• Possible access from outside the EU: Administration and support by group companies outside the EU are technically possible
• Basis for the transfer: EU standard contractual clauses plus the EU–US adequacy decision
• Notice of new further processors according to the provider: at least 30 days before a new further processor processes data (Cloud Data Processing Addendum, section 11.4 a)

• Purpose: Analytics mirror for large-scale queries of your own; enabled per tenant
• Role: Processor (Art. 28 GDPR)
• Place of processing: EU – europe-west3 (Frankfurt)
• Contracting party: Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland
• Possible access from outside the EU: Administration and support by group companies outside the EU are technically possible
• Basis for the transfer: EU standard contractual clauses plus the EU–US adequacy decision
• Notice of new further processors according to the provider: at least 30 days before a new further processor processes data (Cloud Data Processing Addendum, section 11.4 a)

• Purpose: Language model behind the data assistant in the portal; receives the question, metrics and, where the question calls for it, individual conversions and journeys
• Role: Processor (Art. 28 GDPR)
• Place of processing: EU – europe-west3 (Frankfurt)
• Contracting party: Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland
• Possible access from outside the EU: Administration and support by group companies outside the EU are technically possible
• Basis for the transfer: EU standard contractual clauses plus the EU–US adequacy decision
• Notice of new further processors according to the provider: at least 30 days before a new further processor processes data (Cloud Data Processing Addendum, section 11.4 a)

• Purpose: Mailbox for support, contract and data-subject requests; measurement data only where it appears in that correspondence
• Role: Processor (Art. 28 GDPR)
• Place of processing: Data region Europe, set by policy on 18 September 2026; exceptions for logs and cache and the migration status remain to be evidenced
• Contracting party: Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland
• Possible access from outside the EU: Administration and support by group companies outside the EU are technically possible
• Basis for the transfer: EU standard contractual clauses plus the EU–US adequacy decision
• Notice of new further processors according to the provider: at least 30 days before a new further processor processes data (Data Processing Amendment for Google Workspace, section 11.4 a)

• Purpose: Sending our newsletter; for a transition period, receiving inbound support mail. System and support e-mails have been sent via Google Workspace since 1 October 2026
• Role: Processor (Art. 28 GDPR)
• Place of processing: EU – France and Germany (OVH), Belgium (Google Cloud)
• Contracting party: Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany – under Brevo’s terms for customers based in Germany; parent company Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France
• Possible access from outside the EU: Customer support and maintenance by Brevo group companies in India, the US and Canada; content delivery network and web application firewall (Cloudflare), ticketing (Zendesk) and dashboards (Omni) by providers based in the US
• Basis for the transfer: EU standard contractual clauses with supplementary measures; for the US additionally the EU–US adequacy decision (Data Privacy Framework); for Canada the adequacy decision
• Scope on the client’s behalf: The only thing we still actively send via Brevo is our newsletter, as our own processing without data from your engagement; support e-mails and system e-mails with measurement results, such as weekly and monthly reports with a CSV attachment, have gone via Google Workspace since 1 October 2026. On behalf of our customers, Brevo therefore only processes two things: inbound support e-mails, which for a transition period are also received through the Brevo inbound route until we switch it off, insofar as they contain data from the engagement; and copies and logs of support and system e-mails from before the switch that may still exist at Brevo. Aggregated metrics in them too can allow conclusions about individual persons where case numbers are small. Brevo is removed from this annex once the inbound route is switched off and the deletion of these holdings at Brevo is completed and evidenced
• Notice of new further processors according to the provider: before engagement, without a fixed period (data protection agreement, section 7.3). The DPA rule for sub-processors without secured notice therefore applies: from receipt of a notice, we switch off the Brevo inbound route for support e-mails, insofar as it still exists, and delete there what Brevo’s interfaces allow

They receive data but follow their own statutory duties, and to that extent not our instructions. A processing agreement is not the right paper for that part. They are listed here regardless, because a list naming only one half suggests there is no other.

None at present.

Advertising platforms are not processors. A transfer to them takes place only if the tenant explicitly switches on conversion forwarding — and then as processing in its own right, in joint or separate controllership depending on the platform.

Recipients the client determines itself, such as the target of a webhook, a Slack or Teams channel, a connected AI tool or the CRM its forms send to, do not become our further processors through its instruction.

Stripe handles only our own billing with you and receives no data from the processing on your behalf. It is therefore not listed in this annex but in the overview “Service providers and recipients” and in our privacy notice.

For our own in-house analysis we use no tool that touches our customers’ data.