Art. 28 GDPR
Our sub-processors
This page is the complete, continuously maintained list that our Terms & Conditions (Annex 2 to the DPA) and our privacy policy refer to.
Last updated: 27 October 2026
Cloud-Spheres engages the following processors to provide the services, for consumers and businesses alike. A data processing agreement pursuant to Art. 28 GDPR is in place with each of them.
For every provider we state the purpose of processing, the place of processing and, where personal data reaches a country outside the EU/EEA, the specific Chapter V GDPR safeguard that transfer relies on.
| Sub-processor | Purpose | Processing location | Third country | Safeguard |
|---|---|---|---|---|
| ActiveCampaign, LLC (Postmark) | Sending transactional email (registration, order, invoice) | USA (SCC + DPF) | SCC / DPF | EU Standard Contractual Clauses (Module 2/3) and the EU-US Data Privacy Framework |
| Mailjet SAS | Failover for sending transactional email | Paris (France) | EU/EEA | no third-country transfer |
| Contabo GmbH | Server and VPS infrastructure | Nuremberg, Munich (Germany) | EU/EEA | no third-country transfer |
| OVH GmbH | Dedicated servers for premium game servers and infrastructure | France; remote maintenance by OVHcloud group companies possibly also outside the EU/EEA (SCC) | SCC / DPF | EU Standard Contractual Clauses (Module 2/3) |
| Hetzner Online GmbH | Off-site backup storage, edge-proxy nodes | Falkenstein, Nuremberg (Germany) | EU/EEA | no third-country transfer |
| Amazon Web Services EMEA SARL | EU cloud-compute bursting, managed services | eu-central-1 Frankfurt, eu-west-1 Dublin | EU/EEA | no third-country transfer |
| Cloudflare Germany GmbH | DDoS protection, DNS, edge caching, TLS termination | EU edge PoPs; threat-intel ops USA (SCC + DPF) | SCC / DPF | EU Standard Contractual Clauses (Module 2/3) and the EU-US Data Privacy Framework |
| Stripe Payments Europe Ltd. | Payment processing, tokenisation, fraud scoring | Dublin (primary); support/fraud ops USA (SCC + DPF) | SCC / DPF | EU Standard Contractual Clauses (Module 2/3) and the EU-US Data Privacy Framework |
| FastBill GmbH | Invoice generation and archiving (§ 14 German VAT Act, GoBD) | Germany | EU/EEA | no third-country transfer |
| Microsoft Ireland Operations Limited | M365 for business communication, support-ticket backend, CRM | EU Data Boundary (NL, IE, FI); telemetry USA (SCC + DPF) | SCC / DPF | EU Standard Contractual Clauses (Module 2/3) and the EU-US Data Privacy Framework |
| Functional Software, Inc. dba Sentry | Application-error aggregation (PII scrubber active) | EU region primary; support ops USA (SCC) | SCC / DPF | EU Standard Contractual Clauses (Module 2/3) |
| Google Ireland Limited | Reach measurement and usage statistics (Google Analytics 4) | Dublin (Ireland); analytics ops USA (DPF + SCC) | SCC / DPF | EU Standard Contractual Clauses (Module 2/3) and the EU-US Data Privacy Framework |
This page is updated whenever the set of providers changes; the date above is the revision date of the list. For business customers we additionally announce the replacement or addition of a sub-processor in text form 30 days in advance pursuant to § 7 of the DPA (see § 9 of the Terms); a right to object applies within that period.
Questions about an individual processor, about the Standard Contractual Clauses or about our technical and organisational measures are answered at legal@cloud-spheres.com.
The same list forms part of the following documents:
We answer enquiries about agreements, safeguards and TOMs.
Data protection and legal: legal@cloud-spheres.com
Cloud Spheres UG (haftungsbeschränkt)
Last updated: 27 October 2026