PrivXS Subprocessor Register
1. Purpose and scope
SP-EN-1.1 This register accompanies the PrivXS Data Processing Agreement. Only parties processing customer-organisation personal data on Koowde's instructions are listed as active subprocessors in section 2.
SP-EN-1.2 Register version: 2026-08-06-v1. Koowde assesses suppliers before use and periodically thereafter. A material change is notified to customer organisations under the Data Processing Agreement.
2. Active subprocessors
| Party | Service and data | Primary location and possible access | Safeguard |
|---|---|---|---|
| Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland | Microsoft Azure for production infrastructure, Kubernetes, database, secrets and platform services. This may include account, organisation, guest-list, subscriber, order, campaign and log data. | Primary hosting in a selected EEA region. Global support and further subprocessors may apply according to the Microsoft service and list. | Microsoft Products and Services DPA; SCCs and EU-U.S. Data Privacy Framework where applicable; supplementary measures per service. |
| TransIP B.V., Vondellaan 47, 2332 AA Leiden, the Netherlands, Chamber of Commerce 24345899 | TransIP Object Store for uploads and protected backups. | According to the service information, objects are stored redundantly in Dutch data centres. | Processing terms, supplier assessment, access restriction and encrypted transfer; no transfer outside the EEA intended for the storage service. |
| Mailgun Technologies, Inc. / Sinch | Transactional and campaign email through the EU endpoint. This includes recipient, message, delivery status, errors, unsubscribe and limited technical metadata. | Selected EU region; support and further subprocessors may operate outside the EEA. | Sinch/Mailgun DPA, SCCs and supplementary measures; further subprocessors according to the current Sinch register. |
3. Parties that are not automatically subprocessors
SP-EN-3.1 Mollie, Sentoo and underlying financial institutions generally process payment data as financial service providers or independent controllers. Google processes data when you deliberately choose Google sign-in. Meta processes advertising and conversion data under the applicable Business Tools terms. Their precise role depends on the function used.
SP-EN-3.2 Under the current design, GitLab is used for source code and technical work files and does not contain the production audience database. If production personal data, exports or backups are later added to GitLab or another supplier, prior assessment and, where required, addition as a subprocessor will take place.
4. Questions and changes
SP-EN-4.1 Send questions about a party, transfer safeguard or change to info@koowde.nl. Privacy questions for the DPO may be sent to fg@koowde.nl.