Sub-processors

Annex 2 — Information on sub-processors

1. Authorised sub-processors. Upon the entry into force of the Clauses, the Controller authorises the engagement of the following sub-processors, for the purposes set out in point 1.1 of Annex 1:

• Cloudflare, Inc. (USA/EU) — hosting, CDN, network security, R2 storage (media and backups), email routing;
• Amazon Web Services EMEA SARL (Luxembourg) — cloud services and infrastructure;
• SendGrid / Twilio Inc. (USA) — transactional email delivery;
• Stripe Payments Europe Ltd. (Ireland) and SumUp Payments Ltd. (UK) — payment services;
• Anthropic, PBC (USA) — language processing for the optional AI assistance features: it receives the text of the conversation messages (stripped of email signatures and quoted text), the name of the Workshop and any instruction given by the operator, as well as — for the conversational AI assistant — the operator's chat text, the page context and the data retrieved from the management software needed for the reply, within the limits of the operator's permissions (which may include personal data of end customers); outside these cases it does not receive the end customer's identification fields; under the contractual commitments in place, the content is not used to train the provider's models and is retained by the provider only for the time strictly necessary for processing.

The up-to-date list, with full company details, is published at crankpal.com/subprocessors. The use of the listed sub-processors for purposes other than those set out in point 1.1 of Annex 1 requires the Controller's written authorisation.

2. Prior notice for new sub-processors. The Processor shall give notice of the addition or replacement of sub-processors at least 30 days in advance through the management software and by email to the account administrator; the Controller may object in writing within that period. In the absence of an objection, the authorisation shall be deemed confirmed. The renewal of a contract with an already authorised sub-processor, on unchanged data protection terms, does not require a new authorisation.