Subprocessors
v2.0.0As of: May 26, 2026
List of Subprocessors
Annex 3 to the Data Processing Agreement (DPA)
Version 1.1.0 · effective 2026-05-19
P&P Unternehmensgruppe Marco Pavlov Pereira engages the following subprocessors for platform services. This list is maintained on an ongoing basis and is deemed generally authorised within the meaning of Art. 28(2) GDPR unless the Controller objects. Changes are announced with at least 30 days' advance notice.
1. Hosting & Infrastructure
| Provider | Seat / Region | Purpose | Data categories | Parent |
|---|---|---|---|---|
| Vercel Inc. | Processing: Frankfurt (fra1) · Counterparty: Vercel Germany GmbH | Web application hosting, CDN, edge functions | all platform data (transient: request routing and SSR) | USA |
| Supabase Inc. | Processing: Frankfurt (eu-central-1) · Counterparty: Supabase Inc. (SCC 2021/914) | Database (PostgreSQL), authentication, storage, realtime | all persistent application data | USA |
2. Email Delivery
| Provider | Seat / Region | Purpose | Data categories |
|---|---|---|---|
| Named on request — system notifications | EU | Transactional email (notifications, password reset) | recipient email, subject, body |
3. Observability / Error Tracking
| Provider | Seat / Region | Purpose | Data categories |
|---|---|---|---|
| Named on request | EU region where possible | Aggregated error logs, performance metrics | technical logs, IP, user agent (for reproduction) |
4. Third-Country Relationship
(1) Subprocessors under 1. have US parent companies. Physical data processing takes place exclusively in the EU (Frankfurt am Main).
(2) A Transfer Impact Assessment (TIA) for US cloud providers with EU data centres exists and is available on Controller's request.
(3) Standard Contractual Clauses pursuant to Commission Implementing Decision 2021/914 are in place with all US providers, supplemented by additional measures (encryption in transit and at rest, key management in the EU).
5. List Updates
This list is reviewed regularly and updated upon changes. Controllers are informed of changes with at least 30 days' advance notice in writing or by email. Within this period, the Controller may object on legitimate grounds.
6. Final Provisions
(1) This list is an annex to the Data Processing Agreement (DPA).
(2) The German version is binding in case of conflict.
SHA-256: 4c8faeb448421c675ab39f3d382f93879946d7632d615afc558a724967693e14