This annex lists all sub-processors authorised by Actuals Oy (Commslayer) to process Personal Data on behalf of the Controller. The Controller authorises the engagement of these sub-processors, subject to the conditions set out in Section 7 of the Data Processing Agreement. Changes to this list will be communicated to the Controller in advance via email. The Controller may object on reasonable data protection grounds within 14 days of the notice, in accordance with Section 7 of the Data Processing Agreement; if no objection is made within that period, the change is deemed accepted.
Google Cloud Platform
Cloud-based services for application functionality and data processing
| Legal Entity | Google Cloud EMEA Limited |
|---|---|
| Registration Number | IE 660412 |
| Registered Address | 70 Sir John Rogerson’s Quay, Dublin 2, D02 R296, Ireland |
| Country | Ireland (EU) |
| Processing Location | United States (us-central1, us-west1) and other non-EU regions |
| Categories of Personal Data | Customer messages, contact information, order details, voice call data, and related business data processed through cloud services |
| Types of Data Subjects | End customers of Commslayer merchants, support agents |
| Security Certifications | ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, SOC 2 Type II, SOC 3 |
| Transfer Mechanism | Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework, incorporated by reference in the Google Cloud Data Processing Addendum and in Google’s Data Processing Addendum for Products Where Google is a Data Processor |
| DPA/Privacy Documentation | cloud.google.com/terms/data-processing-addendum, business.safety.google/processorterms |
Hetzner Online GmbH
Primary hosting infrastructure for application servers, databases, and file storage
| Legal Entity | Hetzner Online GmbH |
|---|---|
| Registration Number | HRB 85845 |
| Registered Address | Industriestrasse 25, 91710 Gunzenhausen, Germany |
| Country | Germany (EU) |
| Processing Location | Germany (Falkenstein, Nuremberg, Helsinki) |
| Categories of Personal Data | All data categories: customer contact details, messages, order information, authentication data, system logs |
| Types of Data Subjects | All: merchants (Commslayer users), end customers, support agents |
| Security Certifications | ISO/IEC 27001 |
| Transfer Mechanism | EU-based processing (no transfer outside EU/EEA) |
| DPA/Privacy Documentation | hetzner.com/legal/data-privacy-faq |
Amazon Web Services
Secondary hosting, CDN, and infrastructure services
| Legal Entity | Amazon Web Services EMEA SARL |
|---|---|
| Registration Number | B186284 |
| Registered Address | 38 Avenue John F. Kennedy, L-1855 Luxembourg |
| Country | Luxembourg (EU) |
| Processing Location | European Union (eu-central-1, eu-west-1) |
| Categories of Personal Data | Same as Hetzner (backup and redundancy) |
| Types of Data Subjects | All: merchants, end customers, support agents |
| Security Certifications | ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, SOC 1, SOC 2, SOC 3, PCI DSS Level 1 |
| Transfer Mechanism | EU-based processing (adequacy maintained within EU) |
| DPA/Privacy Documentation | aws.amazon.com/compliance/gdpr-center |
Postmark
Transactional email delivery (notifications, agent alerts, system emails)
| Legal Entity | AC PM LLC (an ActiveCampaign company) |
|---|---|
| Registration Number | Delaware LLC |
| Registered Address | 1 N Dearborn Street, Suite 500, Chicago, IL 60602, USA |
| Country | United States |
| Processing Location | United States |
| Categories of Personal Data | Email addresses, customer names, email content, delivery logs |
| Types of Data Subjects | Merchants, support agents, end customers |
| Security Certifications | SOC 2 Type II |
| Transfer Mechanism | EU-US Data Privacy Framework (AC PM LLC is covered by ActiveCampaign, LLC’s certification), with Standard Contractual Clauses (SCCs) as a fallback, per the Postmark Data Processing Addendum |
| DPA/Privacy Documentation | postmarkapp.com/dpa |
Sentry
Error monitoring, crash reporting, performance monitoring
| Legal Entity | Functional Software, Inc. |
|---|---|
| Registration Number | Delaware C-Corp |
| Registered Address | 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA |
| Country | United States |
| Processing Location | United States |
| Categories of Personal Data | Error logs, stack traces, potentially email addresses or usernames in error context (PII scrubbing configured) |
| Types of Data Subjects | Merchants, support agents |
| Security Certifications | SOC 2 Type II, ISO 27001 |
| Transfer Mechanism | EU-US Data Privacy Framework (Functional Software, Inc. self-certified), with Standard Contractual Clauses (SCCs) as a fallback, per the Sentry Data Processing Addendum |
| DPA/Privacy Documentation | sentry.io/legal/dpa |
Shopify
Source platform — API access to retrieve merchant store data, customer information, orders, and products for helpdesk functionality
| Legal Entity | Shopify International Limited (EU merchants) / Shopify Inc. (non-EU) |
|---|---|
| Registration Number | Ireland: 510177 / Canada: Corporation #1187946 |
| Registered Address | Victoria House, 1-2 Victoria Road, Dublin 6, Ireland / 151 O’Connor Street, Ottawa, ON K2P 2L8, Canada |
| Country | Ireland (EU) / Canada |
| Processing Location | Data originates from and remains on Shopify infrastructure (multi-region) |
| Categories of Personal Data | All merchant and customer data accessed via API: names, emails, phone numbers, addresses, order history, product data, customer service interactions |
| Types of Data Subjects | Merchants (Commslayer users), their end customers |
| Security Certifications | ISO/IEC 27001, SOC 2 Type II, PCI DSS Level 1 |
| Transfer Mechanism | No transfer outside EU/EEA (Shopify International Limited, Ireland) / EU adequacy decision for Canada (Shopify Inc., Canada) |
| DPA/Privacy Documentation | shopify.com/legal/dpa |
Twilio
Telephony provider for phone support and Voice AI: phone numbers, inbound and outbound calls, call recording, voicemail, and real-time speech recognition and speech synthesis during calls. Twilio engages its own sub-processors for speech services (Deepgram, ElevenLabs, Google, Amazon Web Services), listed at twilio.com/legal/sub-processors.
| Legal Entity | Twilio Ireland Limited (subsidiary of Twilio Inc., USA) |
|---|---|
| Registration Number | Ireland: 557454 |
| Registered Address | 70 Sir John Rogerson’s Quay, Dublin 2, D02 R296, Ireland |
| Country | Ireland (EU) |
| Processing Location | United States |
| Categories of Personal Data | Caller and agent phone numbers, call metadata (time, duration, caller ID), call audio and recordings, voicemail audio, speech transcribed to text in real time during calls, keypad inputs, and business registration details, addresses and identity documents submitted by merchants for phone number regulatory compliance |
| Types of Data Subjects | End customers of Commslayer merchants (callers), support agents, merchants (Commslayer users) |
| Security Certifications | ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, SOC 2 Type II |
| Transfer Mechanism | Standard Contractual Clauses incorporated in the Twilio Data Protection Addendum, Twilio Binding Corporate Rules, and the EU-U.S. Data Privacy Framework (Twilio Inc. self-certified) |
| DPA/Privacy Documentation | twilio.com/legal/data-protection-addendum |
OpenAI
Cloud-based services for application functionality and data processing
| Legal Entity | OpenAI Ireland Limited |
|---|---|
| Registration Number | IE 737350 |
| Registered Address | 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland |
| Country | Ireland (EU) |
| Processing Location | United States and other non-EU regions |
| Categories of Personal Data | Customer messages and attachments, contact information, order and subscription details, voice call transcripts, and related business data processed through cloud services |
| Types of Data Subjects | End customers of Commslayer merchants, support agents |
| Security Certifications | ISO/IEC 27001, ISO/IEC 27701, SOC 2 Type II |
| Transfer Mechanism | Standard Contractual Clauses (SCCs) between OpenAI Ireland Limited and its affiliates and sub-processors outside the EEA, as set out in the OpenAI Data Processing Addendum |
| DPA/Privacy Documentation | openai.com/policies/data-processing-addendum |
