← Legal documents

    Subprocessors

    These providers process data on our behalf. We have a data processing agreement with each of them, except Apple (see below). Where the provider publishes it, we link to it here.

    As of September 2026 · Full details in the DPA, annexes 1 and 2 (German)

    Supabase Inc.

    Database, sign-in, realtime functions

    EU (Frankfurt) · SOC 2 Type II

    PublicData Processing Addendum
    Vercel Inc.

    Application hosting

    EU (Frankfurt) · SOC 2 Type II, ISO 27001, DPF, SCCs

    PublicData Processing Addendum
    Zoho Corporation B.V. (Niederlande)

    Email mailbox

    EU (Netherlands) · ISO 27001, SOC 2 Type II

    On requestZoho GDPR page

    Not public. We send you the agreement on request.

    Request by email
    Brevo (Sendinblue SAS)

    Technical emails and emails sent from the software

    EU (France, Germany, Belgium) · ISO 27001, DPF, SCCs

    PublicData Protection Agreement (PDF)
    Functional Software, Inc. (Sentry)

    Error monitoring

    EU (Frankfurt) · SOC 2 Type II, ISO 27001, DPF, SCCs

    PublicData Processing Addendum
    Finbc GmbH (ONE finance)

    E-invoicing and contract billing

    Germany · DPA

    On requestPrivacy policy

    Not public. We send you the agreement on request.

    Request by email
    Google Cloud (Vertex AI)

    Optional AI features, only when switched on

    EU multi-region (exception: image generation) · ISO 27001, SOC 2 Type II, DPF, SCCs

    PublicCloud Data Processing Addendum
    Cloudflare Inc.
    Parent and staff app only

    Connection for the parent and staff app

    EU (Frankfurt) · ISO 27001, SOC 2 Type II, DPF, SCCs

    PublicData Processing Addendum
    Expo (650 Industries Inc.)
    Parent and staff app only

    Sending push notifications

    USA (transit only) · SOC 2 Type II, SCCs

    On requestExpo Trust Center

    Not public. We send you the agreement on request.

    Request by email
    Google Ireland Ltd. (Firebase Cloud Messaging)
    Parent and staff app only

    Push notifications on Android

    Global (transit only) · ISO 27001, SOC 2, DPF, SCCs

    PublicData Processing and Security Terms
    Apple Distribution International Ltd. (APNs)
    Parent and staff app only

    Push notifications on iOS

    Global (transit only) · ISO 27001, SOC 2, DPF

    No DPAApple Developer Program License Agreement

    On request

    Zoho, Expo and Finbc do not publish their agreement; it is issued to customers directly. Contract partners can get our copy from us.

    Apple (iOS push)

    Apple does not offer a data processing agreement for its push service. The basis is the Apple developer agreement (Attachment 1). Push is optional and can be declined on the device.

    Evidence and changes

    Contract partners receive signed copies and audit reports on request. We only add new subprocessors after you have agreed (DPA §9). info@bienenstock-kita.de