Envra engages providers in different roles. Some process personal data on behalf of Envra as subprocessors in relation to customer data. Others provide services where Envra itself is the controller or act as independent controllers. The providers that receive data depend on the features and integrations used by the customer.
Overview
| Legal entity | Service and role | Purpose | Data categories | Processing location | Transfer mechanism |
|---|---|---|---|---|---|
| Hetzner Online GmbH | Subprocessor – hosting and infrastructure | Operations, storage, backups and technical infrastructure | Customer data, account information, customer content, analytics data and logs | Finland and Germany | Processing within the EEA |
| OpenAI Ireland Limited | Subprocessor when the customer activates relevant AI features | Processing and generation of text, images, audio and other content | Instructions, customer content, uploaded files, media, technical identifiers and generated results | EEA and other stated processing locations | Adequacy decision and/or the EU Standard Contractual Clauses, depending on the processing location |
| Stripe Payments Europe, Limited and relevant Stripe entities under the account agreement | Payment provider; processor and/or independent controller depending on the processing | Payments, subscriptions, invoicing, security, fraud prevention and legally required financial controls | Account, contact, subscription, invoice, payment and transaction data | EEA and United States | EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses |
| Google Ireland Limited | Independent controller for Google login; the customer’s selected provider for enabled Google integrations | Authentication and integrations activated by the customer | Name, email address, unique identifier and data from enabled integrations | EEA and other stated processing locations | The provider’s applicable transfer mechanisms |
| Microsoft Ireland Operations Limited | Independent controller for Microsoft login; the customer’s selected provider for enabled Microsoft integrations | Authentication and integrations activated by the customer | Name, email address, unique identifier and data from enabled integrations | EEA and other stated processing locations | The provider’s applicable transfer mechanisms |
| The Rocket Science Group LLC d/b/a Mailchimp | Communications provider and/or the customer’s selected integration provider | Service communications, newsletters and enabled Mailchimp features | Contact information, recipient data, and campaign, delivery and interaction data | United States | EU Standard Contractual Clauses |
| One.com Group AB | Subprocessor – transactional and service email | Sending and delivery of email | Name, email address, message content, delivery status and technical logs | Denmark | Processing within the EEA |
Changes
Envra will notify customers at least 30 days before engaging a new subprocessor or replacing an existing subprocessor. Further rules on notification and objections are set out in the Data Processing Agreement. Changes that relate only to providers used by Envra as controller will be published in this overview and notified separately where required by applicable law.
Customer responsibilities
The customer is responsible for assessing whether its use of the Service and the relevant subprocessors is compatible with the customer’s own obligations as controller.
Contact
Questions about subprocessors may be sent to: