This annex lists all sub-processors authorised by Actuals Oy (Commslayer) to process Personal Data on behalf of the Controller. The Controller authorises the engagement of these sub-processors, subject to the conditions set out in Section 7 of the Data Processing Agreement. Changes to this list will be communicated to the Controller at least thirty (30) days in advance via email, during which time the Controller may object on reasonable data protection grounds.
Google Cloud Platform
Cloud-based services for application functionality and data processing
| Legal Entity | Google Ireland Limited |
|---|---|
| Registration Number | IE 368047 |
| Registered Address | Gordon House, Barrow Street, Dublin 4, Ireland |
| Country | Ireland (EU) |
| Processing Location | United States (us-central1, us-west1) and other non-EU regions |
| Categories of Personal Data | Customer messages, contact information, order details, and related business data processed through cloud services |
| Types of Data Subjects | End customers of Commslayer merchants, support agents |
| Security Certifications | ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, SOC 2 Type II, SOC 3 |
| Transfer Mechanism | Standard Contractual Clauses (SCCs) — Incorporated by reference in Google Cloud Data Processing Addendum, which forms part of Cloud Terms of Service |
| DPA/Privacy Documentation | cloud.google.com/terms/data-processing-addendum |
Hetzner Online GmbH
Primary hosting infrastructure for application servers, databases, and file storage
| Legal Entity | Hetzner Online GmbH |
|---|---|
| Registration Number | HRB 85845 |
| Registered Address | Industriestrasse 25, 91710 Gunzenhausen, Germany |
| Country | Germany (EU) |
| Processing Location | Germany (Falkenstein, Nuremberg, Helsinki) |
| Categories of Personal Data | All data categories: customer contact details, messages, order information, authentication data, system logs |
| Types of Data Subjects | All: merchants (Commslayer users), end customers, support agents |
| Security Certifications | ISO/IEC 27001 |
| Transfer Mechanism | EU-based processing (no transfer outside EU/EEA) |
| DPA/Privacy Documentation | hetzner.com/legal/data-privacy-faq |
Amazon Web Services
Secondary hosting, CDN, and infrastructure services
| Legal Entity | Amazon Web Services EMEA SARL |
|---|---|
| Registration Number | B186284 |
| Registered Address | 38 Avenue John F. Kennedy, L-1855 Luxembourg |
| Country | Luxembourg (EU) |
| Processing Location | European Union (eu-central-1, eu-west-1) |
| Categories of Personal Data | Same as Hetzner (backup and redundancy) |
| Types of Data Subjects | All: merchants, end customers, support agents |
| Security Certifications | ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, SOC 1, SOC 2, SOC 3, PCI DSS Level 1 |
| Transfer Mechanism | EU-based processing (adequacy maintained within EU) |
| DPA/Privacy Documentation | aws.amazon.com/compliance/gdpr-center |
Postmark
Transactional email delivery (notifications, agent alerts, system emails)
| Legal Entity | Wildbit, LLC |
|---|---|
| Registration Number | Delaware LLC |
| Registered Address | 225 Chestnut Street, Philadelphia, PA 19106, USA |
| Country | United States |
| Processing Location | United States |
| Categories of Personal Data | Email addresses, customer names, email content, delivery logs |
| Types of Data Subjects | Merchants, support agents, end customers |
| Security Certifications | SOC 2 Type II |
| Transfer Mechanism | Standard Contractual Clauses (SCCs) — Execute via postmarkapp.com/dpa |
| DPA/Privacy Documentation | postmarkapp.com/dpa |
Sentry
Error monitoring, crash reporting, performance monitoring
| Legal Entity | Functional Software, Inc. |
|---|---|
| Registration Number | Delaware C-Corp |
| Registered Address | 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA |
| Country | United States |
| Processing Location | United States |
| Categories of Personal Data | Error logs, stack traces, potentially email addresses or usernames in error context (PII scrubbing configured) |
| Types of Data Subjects | Merchants, support agents |
| Security Certifications | SOC 2 Type II, ISO 27001 |
| Transfer Mechanism | Standard Contractual Clauses (SCCs) — Execute via sentry.io/legal/dpa/ |
| DPA/Privacy Documentation | sentry.io/legal/dpa |
Shopify
Source platform — API access to retrieve merchant store data, customer information, orders, and products for helpdesk functionality
| Legal Entity | Shopify International Limited (EU merchants) / Shopify Inc. (non-EU) |
|---|---|
| Registration Number | Ireland: 510177 / Canada: Corporation #1187946 |
| Registered Address | Victoria House, 1-2 Victoria Road, Dublin 6, Ireland / 151 O’Connor Street, Ottawa, ON K2P 2L8, Canada |
| Country | Ireland (EU) / Canada |
| Processing Location | Data originates from and remains on Shopify infrastructure (multi-region) |
| Categories of Personal Data | All merchant and customer data accessed via API: names, emails, phone numbers, addresses, order history, product data, customer service interactions |
| Types of Data Subjects | Merchants (Commslayer users), their end customers |
| Security Certifications | ISO/IEC 27001, SOC 2 Type II, PCI DSS Level 1 |
| Transfer Mechanism | EU Adequacy Decision (Ireland) / Adequacy decision under EU-UK Trade Agreement / SCCs (Canada) |
| DPA/Privacy Documentation | shopify.com/legal/dpa |
