Sub-Processors

Why This Page Exists

In most engagements we act as a processor under Art. 28 GDPR: the client decides what happens to the personal data, and we carry it out. Art. 28(2) GDPR permits us to engage further processors only with the client’s authorisation, and where that authorisation is a general one, we must inform the client of any intended addition or replacement so that the client can object. This page keeps that list visible between contracts.

The processing described here is governed by the data processing agreement with the respective client. It is not governed by our Privacy & GDPR Center, which covers the personal data we process as a controller in our own right, such as website visits and enquiries.

Current Sub-Processors

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – server infrastructure. Hosts our automation platform (n8n) and the working environments used in mandates. Servers located in Germany.
• HubSpot – CRM and marketing automation, with EU data residency.
• Google Workspace – business email, documents, and file storage. EU/EEA.
• Microsoft 365 – business email, documents, and file storage. EU/EEA.
• Supabase – database services, EU region.
• OpenAI, Google (Gemini), Anthropic – text generation and speech transcription, where a mandate uses them. Transfers to the USA are safeguarded by the EU-U.S. Data Privacy Framework and, where applicable, EU Standard Contractual Clauses.
• Apollo.io (ZenLeads Inc., USA) – contact data enrichment: business email addresses and phone numbers for named contacts, where a mandate uses it. Transfers to the USA are safeguarded by the EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses.
• Surfe (Paris, France) – contact data enrichment, where a mandate uses it. Data is kept in the EU where possible; any transfer outside the EEA is safeguarded by EU Standard Contractual Clauses.
• Lusha (Lusha Systems, Inc., USA) – contact data enrichment, where a mandate uses it. Hosting in Ireland (Amazon Web Services); transfers outside the EEA are safeguarded by EU Standard Contractual Clauses.
• EmailListVerify (EmailListVerify s. r. o., Bratislava, Slovakia) – verification of email addresses before outreach, where a mandate uses it. Servers in the EU.

What Is Not on This List

Tool licences registered and billed directly to the client’s own accounts, as set out in Section 4 of our Terms and Conditions, are the client’s own processors and not ours. We operate them on the client’s instruction inside the client’s own tenancy, and the contractual relationship for that data is between the client and that provider.

Changes and Objections

We inform clients in text form of an intended addition or replacement before it takes effect, using the notification route agreed in the data processing agreement. Clients may object in accordance with Art. 28(2) GDPR.

Questions, or an objection: [email protected].