Sub-processors
Last updated [2026-09-30]. Draft for legal review; bracketed fields are placeholders.
WiFinger hosts the service in the United Kingdom (London). These are the third parties that may process personal data for us, as authorised by the Data Processing Agreement (section 7). Some are used only when you turn the related feature on. List version 2026-10-31. Latest change: Published 30 September 2026, effective 31 October 2026: Amazon Web Services EMEA SARL added as the backup storage provider (encrypted backups in the AWS London region, eu-west-2); IONOS SE no longer stores the off-server backups. This is at least 30 days' notice of the change: you may object on reasonable data protection grounds before 31 October 2026 by replying to the notice email or writing to [email protected] (Data Processing Agreement section 7).
We give account owners at least 30 days’ notice by email and in the admin before adding or replacing a sub-processor, and you can object during that period.
Not on this list, because they are not our sub-processors: the sign-in providers a guest chooses on your portal (Google, Microsoft, Facebook, LinkedIn, Apple), which are independent controllers; and the services you connect yourself, such as your CRM or email marketing tool, Zapier or Make, webhooks, review sites or your Wi-Fi vendor’s cloud controller, which receive data on your instruction under your own agreement with them. [LAWYER TO REVIEW]
| Sub-processor | Purpose | Location | Transfer safeguard | Used |
|---|---|---|---|---|
| IONOS SE Cloud hosting | Servers, database and file storage for the live WiFinger service. Data: All service data | United Kingdom (London data centre) | Data stored in the UK. IONOS SE is established in the EU (UK adequacy regulations). | Always |
| Amazon Web Services EMEA SARL Backup storage | Stores WiFinger's nightly backups for up to 12 months. Backups are encrypted with WiFinger's key before they leave the IONOS server, so AWS cannot read them. Data: All service data, in encrypted backup files | United Kingdom (AWS London region, eu-west-2) | Data stored in the UK. The contracting entity is established in the EU (UK adequacy regulations); AWS Data Processing Addendum. [LAWYER TO REVIEW: confirm the contracting AWS entity and the transfer terms in the AWS DPA] | Always (from 31 October 2026) |
| Microsoft Ireland Operations Ltd (Microsoft 365) Email delivery | Sends system emails and the Customer's email campaigns. Data: Recipient email address, message content | United Kingdom / European Economic Area | UK adequacy regulations (EEA); Microsoft Products and Services DPA with the UK Addendum to the EU SCCs for any onward transfer. | Always |
| Twilio Ireland Ltd / Twilio Inc. SMS delivery | One of WiFinger's SMS providers: sends one-time sign-in codes and the Customer's SMS messages. Data: Mobile number, message content | United States / European Economic Area | UK Extension to the EU-US Data Privacy Framework (certified entity) and the UK Addendum to the EU SCCs in the Twilio DPA. | Only when SMS is enabled and WiFinger routes messages through Twilio |
| Vonage (Vonage SMS API) SMS delivery | One of WiFinger's SMS providers (default route or fallback): sends one-time sign-in codes and the Customer's SMS messages. Data: Mobile number, message content | United States / European Economic Area | UK Addendum to the EU SCCs in the Vonage data processing terms. [LAWYER TO REVIEW: confirm the contracting Vonage entity and transfer mechanism] | Only when SMS is enabled and WiFinger routes messages through Vonage |
| The SMS Works Ltd SMS delivery (UK) | One of WiFinger's SMS providers (UK route): sends one-time sign-in codes and the Customer's SMS messages. Data: Mobile number, message content | United Kingdom | Processed in the UK; no restricted transfer. [LAWYER TO REVIEW: confirm entity name and hosting location] | Only when SMS is enabled and WiFinger routes messages through The SMS Works |
| Stripe Payments Europe Ltd Payments | Card payments and invoices for WiFinger subscriptions (customer billing data only, never guest data). Data: Billing contact, card details (held by Stripe), invoices | European Economic Area / United States | UK adequacy regulations (EEA); UK Extension to the EU-US Data Privacy Framework and the UK Addendum to the EU SCCs in the Stripe DPA. | Paid plans |
| Anthropic PBC AI assistant (Claude API) | Answers analytics questions and drafts copy from aggregated figures and the operator's text. No guest records or contact details are sent. Data: Operator prompts, aggregated analytics, a selected feedback comment | United States | UK Addendum to the EU SCCs in Anthropic's commercial terms / DPA; no training on API data by default. | Only when the AI assistant is enabled with Anthropic |
| OpenAI, L.L.C. AI assistant (OpenAI API) | As for Anthropic, when OpenAI is the selected provider. Data: Operator prompts, aggregated analytics, a selected feedback comment | United States | UK Addendum to the EU SCCs in the OpenAI DPA; no training on API data by default. | Only when the AI assistant is enabled with OpenAI |
| Microsoft Ireland Operations Ltd (Azure OpenAI Service) AI assistant (Azure OpenAI) | As for Anthropic, when Azure OpenAI is the selected provider. Data: Operator prompts, aggregated analytics, a selected feedback comment | United Kingdom / EU region selected by WiFinger | Data at rest in the selected UK / EU geography; Microsoft Products and Services DPA. | Only when the AI assistant is enabled with Azure OpenAI |
| Cloudflare, Inc. DNS, CDN and bot protection for wifinger.com | Delivers the public website and protects its forms (Turnstile). Not used for guest data. Data: Website visitor IP address and connection data, form submissions in transit | Global edge network (United States headquarters) | UK Extension to the EU-US Data Privacy Framework and the UK Addendum to the EU SCCs in the Cloudflare DPA. | Public website |
| Google LLC (Google Business Profile) Online reviews | Reads reviews of the Customer's venue and posts the replies the Customer approves. Data: Public reviews (reviewer name, text), reply text | United States | UK Extension to the EU-US Data Privacy Framework; Google's data processing terms. | Only when the Customer connects Google reviews |
| Trustpilot A/S Online reviews | Reads Trustpilot reviews of the Customer and posts approved replies. Data: Public reviews (reviewer name, text), reply text | Denmark (European Economic Area) | UK adequacy regulations (EEA). | Only when the Customer connects Trustpilot |
| Tripadvisor LLC Online reviews | Reads Tripadvisor reviews of the Customer's venue. Data: Public reviews (reviewer name, text) | United States | UK Addendum to the EU SCCs / UK Extension to the EU-US Data Privacy Framework where certified. | Only when the Customer connects Tripadvisor |