Sub-processors

Annex 2 — Information on sub-processors

1. Authorised sub-processors. Upon the entry into force of the Clauses, the Controller authorises the engagement of the following sub-processors, for the purposes set out in point 1.1 of Annex 1:

• Aruba S.p.A. (Italy) — hosting of the application servers and databases;
• Cloudflare, Inc. (USA/EU) — CDN, network security and traffic routing, R2 storage (media and backups), email routing and delivery;
• Backblaze Inc. (USA, storage in an EU region) — continuous replication of database backups;
• Stripe Payments Europe Ltd. (Ireland) and SumUp Payments Ltd. (UK) — payment services;
• Anthropic, PBC (USA) — language and image processing for the optional AI assistance features: it receives the text of the conversation messages (stripped of email signatures and quoted text), the name of the Workshop and any instruction given by the operator, as well as — for the conversational AI assistant — the operator's chat text, the page context and the data retrieved from the management software needed for the reply, within the limits of the operator's permissions (which may include personal data of end customers), as well as — for the photograph-reading features — only the image concerned (photo of the frame number, of the bicycle and of its components) together with the reading instruction, an image which is not anonymised and may show elements that are not necessary for the analysis; outside these cases it does not receive the end customer's identification fields; under the contractual commitments in place, the content is not used to train the provider's models and is retained by the provider only for the time strictly necessary for processing.
• Openapi S.p.A. (Italy) — verification of the Workshop's tax data, company registry searches and transmission of electronic invoices to the Italian Interchange System;
• GitHub, Inc. (USA, Microsoft group) — handling of the malfunction reports submitted by the Workshop, which may contain the name and email address of the reporter and any attachments included;
• OpenStreetMap Foundation (United Kingdom) — geocoding of the addresses entered in the management system;
• Open-Meteo (Germany) — weather data associated with the coordinates of bicycle rides;
• Apple Inc. (USA/Ireland) — delivery of push notifications to the cyclist app;
• Google LLC (USA/Ireland) — corporate email of the data processor;
• Meta Platforms Ireland Ltd. (Ireland) — WhatsApp Business channel, where enabled by the Workshop;

The up-to-date list, with full company details, is published at crankpal.com/subprocessors. The use of the listed sub-processors for purposes other than those set out in point 1.1 of Annex 1 requires the Controller's written authorisation.

2. Prior notice for new sub-processors. The Processor shall give notice of the addition or replacement of sub-processors at least 30 days in advance through the management software and by email to the account administrator; the Controller may object in writing within that period. In the absence of an objection, the authorisation shall be deemed confirmed. The renewal of a contract with an already authorised sub-processor, on unchanged data protection terms, does not require a new authorisation.