Outflanq B.V. engages the parties below for priceq. The list is complete: if a party is not on it, it receives no personal data. We announce changes at least thirty days in advance, so that a customer can object.
Hetzner Online GmbH
Purpose
Hosting of the application, the database, the queue and the background tasks
DNS, access tunnel, WAF, bot protection (Turnstile) on the forms, and object storage (R2) for the encrypted nightly backup
Data category
Traffic metadata (IP address, user agent, requested URL) plus the encrypted database backup
Location
Global network; the company is established in the United States
Transfer
Standard contractual clauses and EU-US Data Privacy Framework
Data processing agreement
Yes, Cloudflare DPA
Backblaze, Inc. (B2)
Purpose
Offsite copy of the nightly backup, once a day
Data category
The encrypted database backup only
Location
United States
Transfer
Standard contractual clauses
Data processing agreement
Yes, Backblaze DPA
The backup is encrypted with age before it leaves the German cluster. Backblaze holds ciphertext only and does not have the key.
AhaSend B.V.
Purpose
Transactional e-mail: price alerts and overviews, invitations, confirmation and password recovery mails, messages about the trial period and the subscription (including the message that a VAT number could not be verified), and our replies to support messages
Data category
Name and e-mail address of the recipient, and the content of the message: depending on the message, product names, prices and shop names, the company name, the VAT number or the text of a support reply
Location
Amsterdam, the Netherlands (company number 99533111). Processing takes place within the EEA: Hetzner (Germany and Finland), DA International Group (Bulgaria) and Blix Solutions (Norway). They offer servers in the United States on request; we do not use them
Error monitoring: if the application produces an error, it is recorded with a stack trace so that it can be repaired
Data category
Technical: stack trace, URL of the request, browser and version. No request bodies. No personal data from the customer dataset: send_default_pii=False is enabled, so Sentry does not link a user ID or IP address to an error
Location
EU region, Germany (de.sentry.io)
Transfer
None: processing remains within the EU
Data processing agreement
Yes, Sentry DPA
For our own administration and support
For payments, bookkeeping and support we are ourselves the controller (see the privacy statement). The parties below work for us for those purposes, not on behalf of the customer, and are therefore not sub-processors within the meaning of the data processing agreement. They do receive personal data, and are therefore on this list.
Stripe
Purpose
Checking out and collecting subscriptions: iDEAL, SEPA direct debit and credit card
Data category
Name, e-mail address, billing address, VAT number if the customer provides one, and payment details
Location
US group; for European customers Stripe contracts from Ireland
Transfer
Standard contractual clauses and EU-US Data Privacy Framework
Moneybird B.V.
Purpose
Bookkeeping: creating invoices and sending them by e-mail
Data category
Company name, e-mail address, address and VAT number
Location
The Netherlands
Transfer
None: processing remains within the EU
Vimexx (zxcs)
Purpose
Hosting of the mailbox of the support address; priceq retrieves the messages from there
Data category
Name and e-mail address of the sender and the content of the message
Location
The Netherlands
Transfer
None: processing remains within the EU
Fingerprint of this text (SHA-256): cb77632b66c18f5a93fa0d396573f52616088c8be834fa0e1a588cbfad430682