About this list
Rekivo processes personal data on behalf of you, the customer. To deliver the service, we engage the following subprocessors. All subprocessors are bound by data processing agreements (DPAs) under Art. 28 GDPR. This list is part of our DPA — we will notify customers in advance of any addition or change.
Current subprocessors
| Company | Purpose | Data categories | Location | Links |
|---|---|---|---|---|
| Hetzner Online GmbH | Application hosting (servers, database) | All application data: user accounts, invoices, settings, audit logs | Falkenstein / Nuremberg, Germany | |
| Hetzner Online GmbH (Object Storage) | Object storage for invoice files | Original XML and PDF invoice files | Falkenstein / Nuremberg, Germany | |
| MailerSend (MailerLite, UAB) | Transactional email (sign-up, verification, invitations, notifications) and inbound email reception for invoice forwarding | Recipient email addresses, message bodies; inbound: sender addresses + attached invoice files | Vilnius, Lithuania (EU) | |
| Stripe Payments Europe, Ltd. | Subscription billing and payment processing | Email, billing address, last four digits of payment card (no full card data) | Dublin, Ireland (EU) |
International transfers
All subprocessors are based in the EU/EEA. No personal data is transferred outside the EU/EEA. If this changes, we will notify customers and update this page before any transfer takes place.
Changes to this list
We will notify customers by email at least 30 days before any new subprocessor is added or replaced, giving you the right to object before the change takes effect.