These are the companies that process personal data for EUlabel. The first table is the list referred to in our Data Processing Agreement. Customers’ owners get 30 days’ notice by email before a change, and may object as the agreement explains.
Subprocessors for Customer Data
| Company | Service | Where | Transfer safeguard | Certifications they state | Their list |
|---|---|---|---|---|---|
| Vercel Inc. (USA) | Hosting, delivery network, firewall, logs | Functions in Frankfurt. Delivery network worldwide. Logs may be processed in the USA | EU–US Data Privacy Framework, and Standard Contractual Clauses | SOC 2 Type 2, ISO 27001:2022 | security.vercel.com |
| Databricks, Inc. and Neon, LLC (USA) | Database | Frankfurt (AWS eu-central-1) | Standard Contractual Clauses | SOC 2 Type II, ISO 27001:2022, ISO 27701:2019 | Databricks subprocessors |
| Plus Five Five, Inc., trading as Resend (USA) | Service email, inbound mail | Sent from Ireland. Message data and logs stored in the USA | Standard Contractual Clauses | SOC 2 Type II | resend.com/legal/subprocessors |
Providers for EUlabel’s own data
We use these for data we control ourselves, as our privacy notice explains. They do not process Customer Data.
| Company | Service | Where | Transfer safeguard |
|---|---|---|---|
| beehiiv Inc. (USA) | Newsletter | USA | Standard Contractual Clauses |
| Plus Five Five, Inc., trading as Resend (USA) | Account email, invitations and our own mail | As above | As above |
Google and Microsoft act as separate controllers when someone chooses to sign in with them. Have I Been Pwned receives only a partial password hash, which does not identify anyone.
Jurisdiction and government access
Under Article 28 of Regulation (EU) 2023/2854 (the Data Act), we publish the following.
The infrastructure in the first table runs in the European Union where the table says so. It is operated by companies established in the United States, so it is subject to the laws of the United States as well as those of the EU.
Our measures against international government access to non-personal data held in the Union are these. Application and database processing run in the Frankfurt region. Data is encrypted in transit and at rest. The encryption keys are held by our providers, so encryption does not by itself stop a request addressed to them. We will tell the Customer of any request made to us unless the law forbids it, and will disclose only what the law requires.
For personal data, the Standard Contractual Clauses also require the provider to review the lawfulness of a request, to challenge it where there are grounds to do so, and to notify us where it can.