Annex 3 – Sub-processors
| Sub-processor | Service | Data location | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Servers, storage, backup, mail servers (Mailu) | Germany and Finland | EU – not applicable |
| Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 (infrastructure: AWS eu-central-1) | Account database and login for control panel and webmail (Customer account data – not hosted content) | Frankfurt, Germany | EU SCCs (2021/914, Modules 2/3) + UK Addendum for remote access outside the EU |
| BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia | CDN (only where the Customer enables CDN, Pro/Max) | EU company; global edge servers | [[VERIFY bunny.net DPA / SCCs]] |
| Hosting Concepts B.V. (Openprovider), Rotterdam, Netherlands | Domain registration (registrant data); optional secondary DNS | EU | EU – not applicable |
| Resend, Inc., USA [[only if used for system emails about the Customer's services]] | Transactional email | US/EU | EU-US Data Privacy Framework + SCCs |
Stripe acts mainly as an independent controller for payment data and is not a sub-processor for the Customer's hosted content. Registries (Punktum dk, EURid, Verisign etc.) are independent controllers.