Subprocessor Register

This register forms part of the Data Processing Agreement: it lists providers that process personal data to operate PrinterMS. Previous versions are available on request.

Notification of changes

The Provider notifies the Subscriber by email at least 30 days before appointing or replacing a subprocessor. An additional recipient can be requested at privacy@printerms.com. The objection procedure is set out in section 6 of the Data Processing Agreement.

The infrastructure change in September 2026. Between 20 and 25 September 2026, the database, authentication and file storage services previously provided by Supabase Pte. Ltd. were taken over by Google Cloud EMEA Limited and Amazon Web Services EMEA SARL, both already listed in this register; no new contracting party was engaged, and the data remained within the European Union, except for the Identity Platform remnant listed in the table below. Notice of the change was not given 30 days before the migration; the Provider therefore notifies Subscribers retrospectively in the application. The Subscriber may raise an objection under section 6.3 of the Data Processing Agreement within 30 days of the notification; if no reasonable solution can be found after consultation, it may terminate the subscription free of charge and receive a pro-rata refund of unused prepaid fees.

1.Subprocessors (further processors acting on the Provider's behalf)

Subprocessor	Service	Categories of data processed	Data location	Transfer safeguard	Certifications
Google Cloud EMEA Limited (70 Sir John Rogerson's Quay, Dublin 2, Ireland) - Google Cloud Platform	database (Cloud SQL) and its backups; file storage (Cloud Storage); application runtime (Cloud Run), task scheduling (Cloud Tasks, Cloud Scheduler), secret management (Secret Manager), operational logs (Cloud Logging); Vertex AI (Gemini): data extraction from supplier invoices	all subscriber data stored on the platform (customer records, contracts, meter readings, invoice data and PDFs, issue reports, work sheets, application-side user account data); for invoice processing, the full content of the uploaded invoice PDF (including a natural-person supplier's data); IP address and browser identifier in platform request logs	EU - Belgium (europe-west1); automatic database backups in multi-region storage within the EU; Vertex AI through an EU endpoint within the EU	EU contracting entity + Cloud Data Processing Addendum, incorporating SCCs; Google LLC is DPF-certified	ISO 27001/27017/27018/27701, SOC 1/2/3
Amazon Web Services EMEA SARL (38 Avenue John F. Kennedy, L-1855 Luxembourg) and affiliates participating in the AWS service	user authentication (Amazon Cognito: sign-in, password verification, two-factor authentication, single-use email codes); registration protection and invitation text (AWS Lambda); sending transactional and authentication emails; receiving and reliably queuing printer meter report emails (SES, SNS, SQS); administrative audit logs (CloudTrail)	users' and customer portal users' email addresses, names, password verification data, TOTP secrets, authentication events; email sender, recipient, subject, full content and delivery metadata	EU - Ireland (eu-west-1); the dead-letter queue (DLQ) retains messages for no more than 14 days; we do not store raw email in S3; audit logs for no more than 400 days	AWS GDPR DPA, incorporating SCCs; ancillary global support/security operations are possible alongside EU-region services	ISO 27001/27017/27018, SOC 1/2/3
Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA)	website delivery (static content), CDN, DNS, TLS; delivery of DCA Agent installation and update packages; real-time update signals (Workers, Durable Objects)	visitor/user IP addresses and request metadata (temporarily at the edge); real-time signals contain only opaque identifiers and an indication of the affected data area; content stored on the platform and application API traffic do NOT pass through it	global edge network (served from the point closest to the visitor); the state-storage object for real-time signals is restricted to EU jurisdiction	EU-US Data Privacy Framework (DPF - active certification) + SCCs as a fallback	ISO 27001:2022, ISO 27701, ISO 27018, SOC 2 Type II
Google Cloud EMEA Limited (70 Sir John Rogerson's Quay, Dublin 2, Ireland) - Google Workspace Business Starter	receiving, storing and sending mail for the `privacy@printerms.com` and `support@printerms.com` mailboxes	enquirer's name, email address, message, attachments and correspondence metadata	Google's global infrastructure; a data region cannot be configured for the Business Starter plan, so processing outside the EU is possible	Google Workspace Cloud Data Processing Addendum accepted on 15 August 2026, incorporating SCCs	according to Google Workspace's current compliance programmes

1.1Subprocessors being phased out

Subprocessor	Current role	Categories of data processed	Data location	Transfer safeguard	Deletion deadline
Supabase Pte. Ltd. (65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513) - infrastructure: Amazon Web Services	no live processing since 25 September 2026; stores only a sealed copy of the state before the migration to enable recovery	subscriber data and account data stored on the platform as at 25 September 2026	EU - Frankfurt (AWS eu-central-1)	Supabase DPA and EU Standard Contractual Clauses (SCCs, 2021/914) for ancillary access from outside the EU	permanent deletion of the copy by 30 November 2026 at the latest
Google Cloud EMEA Limited - Identity Platform (authentication migration test environment)	no live processing; stores disabled user accounts left over from the September 2026 migration test	a small number of users' email addresses and account identifiers	Google's global infrastructure	Cloud Data Processing Addendum, incorporating SCCs; Google LLC is DPF-certified	permanent deletion by 30 November 2026 at the latest

Notes:

Each provider's register lists its own chain of further subprocessors (Google: cloud.google.com/terms/subprocessors; Cloudflare: cloudflare.com/gdpr/subprocessors; AWS: aws.amazon.com/compliance/sub-processors; Supabase: the DPA subprocessor appendix; Google Workspace: workspace.google.com/terms/subprocessors).
Providers of AI-based development tools used to analyse DCA device-support walks (for example, Anthropic and OpenAI) receive only redacted technical data containing no personal data and are therefore not subprocessors.
Source code storage, CI and storage of DCA Agent release packages (GitHub) are not listed because they do not process live personal data; when installation and update packages are downloaded, the party serving the download sees the downloader's IP address as part of its own service. This remains the case only while no personal data enters a repository, CI log or issue (internal rule).

2.Processors for the Provider's own subscription fees

These providers work with PrinterMS's own customer and subscription billing data; they do not have access to the Subscriber's customer fleet stored in PrinterMS.

Provider	Service and data	Privacy role and location
Stripe Payments Europe, Limited and Stripe entities participating in the service	payment by card or bank transfer, tokenised payment method storage, subscription, transaction and invoice identifiers, billing contact, billing email address and address	processor for payment processing on PrinterMS's instructions; independent or joint controller for fraud prevention, regulatory and its own service development purposes (GDPR Article 26); EEA contracting entity in Ireland, global processing under the Stripe DPA and Data Transfers Addendum (DPF/SCCs)
Billingo Technologies Zrt. (1133 Budapest, Árbóc utca 6. I. emelet; company registration no. 01-10-140802; tax no. 27926309-2-41)	issuing and archiving the official Hungarian VAT invoice for PrinterMS service fees; PrinterMS organisation customer details and invoice line items	PrinterMS's processor for issued invoice data; Hungary / EEA
PostHog, Inc. / PostHog Cloud EU	consent-based web and product events, pseudonymous user/organisation identifiers and masked session replays; customer, printer, financial and form content excluded	processor for PrinterMS's own product development purposes; primary storage in EU - Frankfurt; PostHog DPA and subprocessor terms, SCCs for applicable transfers
Google Ireland Limited / Google Analytics 4	consent-based normalised page views, campaign data, pseudonymous client identifier and certain registration/subscription outcomes; advertising signals, PrinterMS user/organisation identifiers and form content excluded	analytics processor with Google product sharing and advertising features disabled; global infrastructure, Google Ads Data Processing Terms, SCCs and Google LLC's EU-US DPF certification

According to Stripe's own official notice, it may act as both a processor and a controller depending on the circumstances. Billingo's own notice states its processor role for data in invoices issued by the user.

3.External services connected by the Subscriber (NOT subprocessors)

The Subscriber connects the following services to the platform under its own contract and using its own API key; they act on the Subscriber's behalf (as its processor or as an independent controller), rather than as the Provider's subprocessors. On the Subscriber's behalf, the Provider transmits data to these services as an instruction according to the Subscriber's configuration (see section 6 of the Terms of Service for details).

Service	Operator	Role
Billingo	Billingo Technologies Zrt. (1133 Budapest, Árbóc utca 6.; company registration no. 01-10-140802; tax no. 27926309-2-41)	issuing invoices in the Subscriber's own account; NAV reporting through Billingo
Számlázz.hu	KBOSS.hu Kft. (1031 Budapest, Záhony utca 7.; company registration no. 01-09-303201; tax no. 13421739-2-41)	issuing invoices in the Subscriber's own account; NAV reporting through Számlázz.hu