Recipients and subprocessors

Effective: [privacy.effectiveDate.en]

This list names the service providers that process personal data for [company.name] [company.legalForm] ("Handl"). It supplements section 14 of the privacy policy and is Annex 2 to the data processing agreement for businesses. A contract under Art. 28 GDPR is in place with every processor.

We notify providers who have a data processing agreement with us of changes to this list in advance, in text form (§ 7 of the agreement).

Processors

Google Cloud EMEA Limited, Dublin, Ireland
Purpose: running servers and databases, storing uploaded images, logs, calculating driving routes with a self-operated routing service (OSRM; only coordinates are transmitted, no names).
Place of processing: in the European Union.
Third-country link: access from the USA for support and maintenance cannot be ruled out. Basis: adequacy decision (EU-U.S. Data Privacy Framework) and standard contractual clauses.

Google Ireland Limited, Dublin, Ireland (Firebase)
Purpose: sign-in for providers, partners and staff (Firebase Authentication); push notifications to the provider portal and the "Handl Orders" app (Firebase Cloud Messaging).
Third-country link: processing also in the USA. Basis: adequacy decision (EU-U.S. Data Privacy Framework) and standard contractual clauses.

Sendinblue SAS (Brevo), Paris, France
Purpose: sending emails (sign-in codes, access links, notifications about orders and quote requests).
Place of processing: European Union.

650 Industries, Inc. (Expo), Palo Alto, USA
Purpose: push notifications to the "Handl" app. Processed are the device identifier (push token) and the content of the notification.
Third-country link: USA. Basis: standard contractual clauses, or the adequacy decision insofar as the recipient is certified under the EU-U.S. Data Privacy Framework.

Services acting under their own responsibility

These recipients process data not (only) on our behalf but also for their own purposes and under their own responsibility.

Stripe Payments Europe, Limited, Dublin, Ireland
Purpose: payment processing, invoicing and VAT calculation (on our behalf), and identity verification of providers and partners, fraud prevention and anti-money-laundering obligations (under its own responsibility).
Third-country link: processing also by Stripe, Inc. in the USA. Basis: adequacy decision (EU-U.S. Data Privacy Framework) and standard contractual clauses.

OpenStreetMap Foundation, Cambridge, United Kingdom
Purpose: converting addresses and postcodes into coordinates (Nominatim), and map tiles in the provider portal and the admin console, which your browser loads directly.
Third-country link: United Kingdom. Basis: adequacy decision of the European Commission.

Apple Inc. and Google LLC as operators of the push services of the iOS and Android operating systems, which deliver a push notification to the device.

Further recipients

The provider who fulfils an order and the partner company through whose app the order was placed receive order data under their own responsibility (privacy policy, sections 8.2 and 8.3). Tax advisers, auditors and authorities receive data insofar as we are legally obliged to provide it.