Last updated [date of publication]
Sub-processors
These process the personal data in your company's surveys for us, under contracts that bind them as clause 5 of the Data Processing Agreement requires. This list is part of that agreement.
| Sub-processor | What it does | Data it handles | Where |
|---|---|---|---|
| netcup GmbH Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany |
Hosts PlanPicPro: the server, its database and its files, in netcup's data centre in Nuremberg. | Everything stored in PlanPicPro. | Germany (EU) |
| [Email provider: company name] [address] |
Delivers the emails PlanPicPro sends, including invitations to join a company. | The recipient's email address and the message. Invitations name the company, the person who invited and the role. | [country; if outside the EEA, the safeguard] |
Services for our own processing
For accounts, billing, security and our websites we are the controller (Privacy notice). The sub-processors above also handle that data for us: netcup hosts it, and the email provider delivers sign-up codes, password resets and security notices. Two more services are involved:
| Service | What it does | Data it handles | Where |
|---|---|---|---|
| Stripe Payments Europe, Limited Dublin, Ireland, with its US affiliate Stripe, LLC |
Payments: the checkout page, subscriptions, invoices, and the card details screen. Our processor for billing, and an independent controller for its own legal duties and fraud prevention. | For companies that buy seats: the buying manager's email address, the subscription (seats, plan, payments), and what is entered on Stripe's own pages: card details, the cardholder's name and the billing address. We never see card numbers. | EU and USA (EU–US Data Privacy Framework; standard contractual clauses) |
Services that receive no personal data
| Service | What it does | What it receives |
|---|---|---|
| Have I Been Pwned (Pwned Passwords) | Checks that a new password hasn't appeared in a known data breach. | The first 5 characters of a one-way hash of the password, sent from our server. Never the password itself, your email address or your IP address. |
| Let's Encrypt (Internet Security Research Group, USA) | Issues the certificates for HTTPS on our domains. | Our domain names only. |
What we don't use
No analytics, advertising or tracking services, no social media plugins and no AI services, in the app or on the website.
Changes to this list
Before a new or replacement sub-processor starts handling your company's data, we email your company's managers: at least 14 days ahead for a change we make, and within 3 days of hearing about a change one of our sub-processors makes. Managers can object within 7 days (DPA clause 5).
Planned: off-site backups with a second provider in the EU/EEA. We'll give notice before they start.
- [date of publication]: first version.