SUBPROCESSORS
Golova Europe SL (Tax ID B70717004, Calle l’Hospital, 95, Planta 1, Puerta 2, 08001 Barcelona, Spain) engages third-party service providers (“subprocessors”) to process personal data on behalf of its customers in the context of the Services. Each subprocessor acts under a written contract pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR) and provides sufficient guarantees of appropriate technical and organisational measures.
This list forms Annex I of the Data Processing Agreement and is kept up to date. It complements the information published in the Privacy Policy.
| Subprocessor | Legal entity | Purpose | Data location | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Hetzner Online GmbH (Gunzenhausen, Germany) | Hosting and cloud infrastructure | EU (Helsinki, Finland) | EEA — no transfer |
| Cloudflare | Cloudflare Inc. (USA) | CDN, DDoS protection, WAF | Global edge (incl. USA) | SCCs + EU-US DPF (where certified) |
| Stripe | Stripe Payments Europe Ltd (Ireland) | Payment processing | EU (Ireland) with US subsidiaries | SCCs + DPF |
| Brevo | Sendinblue SAS (Paris, France) | Transactional and marketing email | EU (France) | EEA — no transfer |
| Plausible Analytics | Plausible Insights OÜ (Tallinn, Estonia) | Cookieless web analytics | EU (Germany) | EEA — no transfer |
| Crisp | Crisp IM SARL (Nantes, France) | Customer support chat | EU (France) | EEA — no transfer |
| Sentry | Functional Software Inc. (USA) | Error monitoring | EU region | EEA — no transfer (EU region) |
| Google Calendar | Google Ireland Ltd (Dublin, Ireland) | Consultation booking widget | EU and USA | SCCs + EU-US DPF |
| Apple Push Notification Service | Apple Distribution International Ltd (Ireland) | iOS push notifications | EU and USA | SCCs + DPF |
| Firebase Cloud Messaging | Google Ireland Ltd | Android push notifications | EU and USA | SCCs + DPF |
| Anthropic (Claude) | Anthropic PBC (USA) | AI assistant for support & help chat (processes submitted text) | USA | SCCs + DPF |
Before engaging a new subprocessor or replacing an existing one, we will notify customers by email or within the Services at least thirty (30) days in advance. Customers may object to a proposed change on reasonable and demonstrable grounds relating to data protection, in accordance with section 6 of the Data Processing Agreement.
Questions about this list can be sent to privacy@golova.ai.