Annex 3 – Sub-processors
| Sub-processor | Service | Data location | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Servers, storage, backup, mail servers (Mailu) | Germany and Finland | EU – not applicable |
| Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 (infrastructure: AWS eu-central-1) | Account database and login for control panel and webmail (Customer account data – not hosted content) | Frankfurt, Germany | EU SCCs (2021/914, Modules 2/3) + UK Addendum for remote access outside the EU |
| BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia | CDN (only where the Customer enables CDN, Pro/Business) | EU company; global edge servers | Transfers to edge servers outside the EU/EEA take place under bunny.net's data processing agreement |
| Hosting Concepts B.V. (Openprovider), Rotterdam, Netherlands | Domain registration (registrant data); optional secondary DNS | EU | EU – not applicable |
| Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA | AI in the website builder (NinaAI), app builder (AYAAI), translation and setup help (e.g. products and booking services from the Customer's text, CSV files and images), and the AI assistant in webmail (only when the user turns it on). The Claude API processes only the content the Customer or user asks the AI to work on, to return the result. No other AI providers are used. Anthropic does not use API data to train models and retains data only under its API data terms (short-term, for abuse monitoring) | USA | EU SCCs (2021/914) + UK Addendum |
| Resend, Inc., USA | Email to the Customer's visitors: transactional email (contact form, booking, web shop), newsletters and marketing emails the Customer sends or turns on (e.g. abandoned-basket and back-in-stock reminders), and system emails about the Customer's services | US/EU | EU-US Data Privacy Framework + SCCs |
| GatewayAPI (OnlineCity.IO ApS), Denmark | SMS booking reminders (only when the Customer turns SMS on and the end customer has agreed): phone number, first name, service, time and business name | EU (Denmark) | EU – not applicable |
Calendar sync (Google Calendar, Microsoft Outlook): when the Customer connects its own Google or Microsoft account, booking details (service, time, end customer's first name) are transferred to the Customer's calendar on the Customer's instructions and under the Customer's own agreement with Google or Microsoft. Google and Microsoft are not Sitewig's sub-processors for this.
Stripe acts mainly as an independent controller for payment data and is not a sub-processor for the Customer's hosted content. Registries (Punktum dk, EURid, Verisign etc.) are independent controllers.