for the Processing of Personal Data on Behalf of a Controller
pursuant to Art. 28 GDPR
between the Customer:
The identity of the controller is determined by the respective customer agreement and the associated order or account details.
(hereinafter referred to as the "Controller")
and the Processor:
detco GmbH
Haferwende 36
28357 Bremen
Germany
(hereinafter referred to as the "Processor")
This Agreement specifies the data protection obligations of the parties arising from the processing carried out on behalf of the Controller as described in this Agreement and in Annex A "Details of the Processing". It applies to all activities related to the service in which employees of the Processor or third parties engaged by the Processor may come into contact with the Controller's personal data.
The parties acknowledge that, as of 25 May 2018, the EU General Data Protection Regulation (GDPR: Regulation (EU) 2016/679) applies and that the requirements for processing on behalf of a controller are generally governed by Art. 28 GDPR.
The individual agreements in this Data Processing Agreement take precedence over the Processor's General Terms and Conditions (GTC).
Pursuant to Art. 4(1) GDPR, personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as the "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
2. Processor
Pursuant to Art. 4(8) GDPR, a processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
3. Instruction
An instruction is an order, generally issued in writing by the Controller, relating to a specific data-protection-related handling of personal data by the Processor (for example, storage, pseudonymisation, erasure or disclosure). Instructions are issued by the Controller and may be amended, supplemented or replaced by individual instructions. The Controller's instructions must be issued in writing or by email.
1. The Processor processes personal data on behalf of the Controller, or it cannot be ruled out that, in connection with the provision of the services, the Processor may gain access to or become aware of personal data. A data processing agreement is therefore required pursuant to Art. 28 GDPR.
3. Ownership of the personal data rests exclusively with the Controller as the "controller" within the meaning of the GDPR. By virtue of this responsibility, the Controller may request the rectification, erasure, restriction of processing and disclosure of personal data both during the term of the Agreement and after its termination.
1. The subject matter of the processing is set out in Annex A "Details of the Processing".
2. This Agreement shall enter into force upon signature by both parties and shall generally end upon termination of the underlying main agreement in accordance with the GTC. The right to terminate for cause without notice remains unaffected.
The scope, nature and purpose of the processing, as well as the types of data and categories of data subjects, are described in Annex A "Details of the Processing".
The Processor undertakes towards the Controller to comply with the technical and organisational measures that are appropriate and necessary to safeguard the applicable data protection requirements.
1. Since the Processor also performs the services for the Controller outside the Controller's business premises, the Processor must document the technical and organisational measures it has implemented pursuant to Art. 28(3)(c) GDPR and Art. 32 GDPR in conjunction with Art. 5(1) and (2) GDPR, and submit them to the Controller for review.
2. The measures serve data security and ensure a level of protection appropriate to the risk with regard to the confidentiality, integrity, availability and resilience of the systems involved in this processing. In doing so, the state of the art, implementation costs, and the nature, scope and purposes of the processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons within the meaning of Art. 32(1) GDPR, must be taken into account.
3. The technical and organisational measures in place at the time of conclusion of the Agreement are attached to this Agreement as Annex B "Technical and Organisational Measures for Data Protection". The parties agree that changes to the technical and organisational measures may be necessary in order to adapt to technical and legal developments. The Processor shall consult with the Controller in advance regarding material changes that may affect the integrity, confidentiality or availability of personal data. Measures that entail only minor technical or organisational changes and do not adversely affect the integrity, confidentiality or availability of personal data may be implemented by the Processor without consultation with the Controller. The Controller may request an up-to-date version of the technical and organisational measures implemented by the Processor at any time.
1. The Processor may not rectify or erase the data processed on behalf of the Controller, or restrict its processing, on its own initiative, but only on the basis of documented instructions from the Controller. If a data subject contacts the Processor directly in this regard, the Processor shall forward the request to the Controller without undue delay for handling by the Controller.
2. The Processor shall directly implement rights to erasure, rectification, data portability and access only on the basis of documented instructions from the Controller.
3. Copies or duplicates of data shall not be created without the Controller's knowledge. This does not apply to backup copies insofar as they are necessary to ensure proper data processing, or to data required in order to comply with statutory retention obligations or pursuant to a court or official order.
4. Upon completion of the contractually agreed work, or earlier upon request by the Controller, but no later than upon termination of the service agreement, the Processor shall give the Controller the opportunity to access and secure all documents that have come into its possession, processing and usage results created, and data holdings related to the contractual relationship. The same applies to test and reject material. A deletion record shall be provided upon request.
5. Documentation serving as evidence of processing in accordance with the instructions and in a proper manner shall be retained by the Processor beyond the end of the Agreement in accordance with the applicable retention periods. The Processor may hand such documentation over to the Controller upon termination of the Agreement for the purpose of discharging itself from its obligations.
1. The Processor is prohibited from processing personal data for purposes unrelated to the provision of the commissioned services, unless the Controller has given its written consent.
2. The Processor confirms that, insofar as it is legally required to do so, it has appointed a Data Protection Officer pursuant to Arts. 38 and 39 GDPR.
The following person has been appointed as the Processor's Data Protection Officer:
Dr. Stephan Schenk
Buchtstr. 13
28195 Bremen
The Controller shall be notified without undue delay of any change in the Data Protection Officer.
3. The Processor shall inform the Controller without undue delay if, in the Processor's opinion, an instruction issued by the Controller infringes statutory provisions. The Processor is entitled to suspend implementation of the instruction in question until it has been confirmed or amended by the Controller.
4. The Processor shall inform the Controller without undue delay of serious disruptions to operations, suspected data protection breaches or other irregularities in the processing of the Controller's personal data.
5. If the Processor determines, or facts give reason to believe, that personal data processed by it on behalf of the Controller has been subject to a breach of the protection of personal data within the meaning of Art. 33 GDPR (data protection breach or personal data breach), for example because it has been unlawfully transmitted or otherwise unlawfully accessed by third parties, the Processor shall inform the Controller without undue delay and in full, in writing or in text form (fax/email), of the time, nature and scope of the incident or incidents. The notification to the Controller must contain at least the following information:
a. A description of the nature of the personal data breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned.
b. The name and contact details of the Data Protection Officer or another contact point from which further information can be obtained.
c. A description of the likely consequences of the personal data breach.
d. A description of the measures taken or proposed to address the personal data breach and, where appropriate, measures to mitigate its possible adverse effects.
In addition, the Processor is obliged to notify the Controller without undue delay of the measures taken by the Processor to prevent any future unlawful transmission or unauthorised access by third parties.
6. Upon request, the Processor shall provide the Controller with the information necessary for the record of processing activities pursuant to Art. 30(1) GDPR and shall itself maintain a record of processing activities as a processor pursuant to Art. 30(2) GDPR.
7. The Processor shall ensure that employees involved in processing the Controller's personal data have been bound to confidentiality pursuant to Art. 28(3), second subparagraph, point (b), Arts. 29 and 32(4) GDPR, and have previously been familiarised with the data protection provisions relevant to them. The Processor and every person working under its authority who has access to personal data may process such data exclusively in accordance with the Controller's instructions, including the authorisations granted in this Agreement, unless they are legally required to process the data. This confidentiality obligation shall continue after the end of the relevant activity.
8. The Processor shall monitor compliance with the aforementioned obligations and provide appropriate evidence thereof.
9. Furthermore, pursuant to Art. 28(3)(f) GDPR, the Processor undertakes to assist the Controller in complying with the obligations set out in Arts. 34–36 GDPR:
a. By providing all relevant information without undue delay in connection with its information obligations towards data subjects and the Controller.
b. In carrying out its data protection impact assessment.
c. In the context of prior consultation with the supervisory authority.
10. The Controller and the Processor shall cooperate with the supervisory authority, upon request, in the performance of their tasks.
11. The Processor shall inform the Controller without undue delay of any inspections and measures taken by the supervisory authority insofar as they relate to this processing. This also applies if a competent authority conducts investigations in administrative offence or criminal proceedings relating to the processing of personal data in the context of processing on behalf of the Controller at the Processor's premises. No such notification shall be given insofar as it is prohibited by a court or public authority.
12. If the Controller is itself subject to an inspection by the supervisory authority, administrative offence or criminal proceedings, a liability claim by a data subject or third party, or any other claim in connection with processing carried out by the Processor on its behalf, the Processor shall provide the Controller with the best possible assistance.
13. The Processor shall regularly monitor its internal processes and the technical and organisational measures in order to ensure that processing within its area of responsibility complies with the requirements of applicable data protection law and that the rights of data subjects are protected.
1. The Controller is entitled to issue additional instructions to the Processor at any time regarding the nature, scope and procedure of the processing on its behalf. Instructions may be issued:
a. in writing;
b. by fax;
c. by email;
d. orally.
The Controller should confirm oral instructions to the Processor without undue delay in text form (e.g. by fax or email).
2. The Controller shall inform the Processor without undue delay and in full if, during its review of the processing results, it identifies errors or irregularities relating to data protection provisions.
3. The Controller is responsible for the notification obligations arising from Art. 33(1) GDPR.
4. The Controller shall determine by contract or instruction the arrangements for returning the data carriers provided and/or erasing the stored personal data after completion of the processing.
5. If the Controller issues individual instructions that go beyond the scope of services agreed in the contract, the resulting costs shall be borne by the Controller.
The Controller is responsible for safeguarding the rights of data subjects.
If the Processor's assistance is required for the Controller to safeguard data subject rights—in particular the rights of access, rectification, restriction, data portability or erasure—the Processor shall take the measures required in each case in accordance with the Controller's instructions.
3. If a data subject contacts the Processor directly to request the rectification, erasure or restriction of processing of their data, or data portability, the Processor shall forward the request to the Controller without undue delay.
4. Provisions concerning any remuneration for additional work incurred by the Processor in providing assistance in connection with the assertion of data subject rights against the Controller shall remain unaffected.
1. The Controller is entitled, at any time and to the extent necessary, to audit the Processor's compliance with statutory data protection requirements, the contractual arrangements agreed between the parties and the Controller's instructions.
2. The Processor shall provide the Controller with information to the extent necessary to carry out the audit within the meaning of paragraph 1.
3. Following prior notification and subject to a reasonable notice period, the Controller may carry out the audit referred to in paragraph 1 at the Processor's premises during normal business hours. The Controller shall ensure that audits are conducted only to the extent necessary, provided that the Processor's business operations are disrupted by the audits.
4. In the event of measures taken by the supervisory authority against the Controller pursuant to Art. 58 GDPR, the Processor shall provide the Controller with the necessary information, in particular with regard to information and audit obligations.
5. The Processor shall provide evidence of technical and organisational measures that do not relate solely to the specific processing. This may be done by means of:
a. compliance with approved codes of conduct pursuant to Art. 40 GDPR;
b. certification under an approved certification mechanism pursuant to Art. 42 GDPR;
c. current attestations, reports or extracts from reports issued by independent bodies (e.g. auditors, internal audit, the Data Protection Officer, IT security officers or data protection auditors);
d. appropriate certification through an IT security or data protection audit (e.g. in accordance with ISO 27001).
6. The costs incurred for an audit at the Processor's premises pursuant to paragraphs 3 and 4 may be charged to the Controller.
1. The Processor may engage sub-processors as required only with the written consent of the Controller.
2. The Controller agrees that the Processor may engage companies to perform, or subcontract, services required to fulfil its contractual obligations. The sub-processors engaged at the time this Agreement is concluded are listed in Annex C "Sub-processing Arrangements".
3. If a sub-processor is engaged, the Processor shall carefully select that sub-processor and, before engagement, verify that it is able to comply with the agreements made between the Controller and the Processor. In particular, the Processor shall verify in advance and regularly throughout the term of the Agreement that the sub-processor has implemented the technical and organisational measures required to protect personal data under Art. 28(3)(c) and Art. 32 GDPR in conjunction with Art. 5(1) and (2) GDPR. The result of the review shall be documented by the Processor and provided to the Controller upon request. The Processor is obliged to obtain confirmation from the sub-processor that it has appointed a Data Protection Officer pursuant to Arts. 37–39 GDPR.
4. The Processor shall ensure that the provisions agreed in this Agreement and any additional instructions issued by the Controller also apply to the sub-processor. The Processor shall regularly monitor compliance with these obligations.
5. The sub-processor's undertaking must be made in writing. A copy of the written undertaking shall be provided to the Controller upon request.
6. In particular, the Processor shall ensure by contractual arrangements that the Controller's and supervisory authorities' audit rights under § 10 of this Agreement also apply to the sub-processor, and that corresponding audit rights are agreed for the Controller and supervisory authorities. The contract must also stipulate that the sub-processor is required to tolerate such audit measures and any on-site inspections.
1. The Processor undertakes to observe the same confidentiality and secrecy requirements as those applicable to the Controller. The Controller is obliged to inform the Processor of any special confidentiality requirements.
2. The Processor warrants that it is familiar with the data protection provisions applicable from time to time and is experienced in applying them.
3. Both parties undertake to treat all information received in connection with the performance of this Agreement as confidential for an unlimited period of time and to use it solely for the performance of the Agreement. Neither party is entitled to use such information, in whole or in part, for purposes other than those stated above or to make such information accessible to third parties.
4. The foregoing obligation does not apply to information that either party can demonstrably show it received from third parties without being subject to a confidentiality obligation, or that is publicly known.
1. Reference is made to the liability provisions of Art. 82 GDPR.
1. If the Controller's personal data held by the Processor is endangered by attachment or seizure, insolvency or composition proceedings, or other events or measures taken by third parties, the Processor shall inform the Controller without undue delay. The Processor shall also inform all parties responsible in this connection without undue delay that control and ownership of the personal data rest exclusively with the Controller as the "controller" within the meaning of the GDPR.
3. If any provision of these contractual terms is invalid, the remaining provisions shall nevertheless remain valid. The contracting parties undertake to replace any invalid provision or any unintended omission, in good faith, with a provision that comes closest to the common purpose pursued by the contracting parties.
(1) The subject matter of the processing is derived from the SaaS agreement between the parties for the use of the functions made available to the Controller by the Processor under contract as a web application, to which reference is made herein (hereinafter the "Service Agreement").
(2) The duration of this processing corresponds to the term of the Service Agreement.
The person responsible for the proper processing of personal data is:
Dr. Stephan Schenk
Buchtstr. 13
28195 Bremen
The Processor does not itself carry out any processing of personal data for which it is independently responsible. Access to the data takes place only to remedy errors in accordance with the GTC. In the course of remedying such errors, the Processor may gain access to the Controller's data. This may also include personal data.
The commissioned services involve the following types of automated processing of personal data using data processing systems:
Storage of data for the provision of services in accordance with the Service Agreement
The contractually agreed data processing shall take place exclusively in a Member State of the European Union or in another Contracting State to the Agreement on the European Economic Area. Any transfer to a third country requires the Controller's prior consent and may take place only if the special requirements of Arts. 44 et seq. GDPR are met.
Depending on the Service Agreement, the following types of data may be processed:
| Controller's contact details | Name, telephone number, billing address, email |
|---|---|
| Booking history | Analytical data concerning the number of bookings, revenue and conversion rate |
| Customer data (Type 1) | Name, address, email, telephone number |
| Customer data (Type 2) | Booking information (arrival, departure, services booked) |
| Customer data (Type 3) | Additional information recorded by the Controller (e.g. comments) |
The following table shows which SaaS services store the above types of data in the course of providing the services or for a limited period for debugging purposes.
| myIBE | myProfileManager | myGuestMailing | myTraces | Expedia Direct Connect | HRS Direct Connect | Google Connect | Feratel Connect | |
|---|---|---|---|---|---|---|---|---|
| Controller's contact details | x | x | x | x | x | x | x | x |
| Booking history | x | |||||||
| Customer data (Type 1) | x | x | (x)* | (x)* | (x)* | (x)* | (x)* | |
| Customer data (Type 2) | x | x | (x)* | (x)* | (x)* | (x)* | (x)* | |
| Customer data (Type 3) | x | x |
*Stored in logs for debugging purposes (automatic deletion after 30 days).
The following categories of persons are affected by the data processing:
· Controller
· Customers
· Employees of the Controller
The following recipients are granted access to personal data for processing purposes:
· Processors within the meaning of Art. 28 GDPR
Personal data is processed on the following legal bases:
· Necessity for the performance of a contract
· Legal obligation
The personal data to be processed shall be properly and irretrievably erased by the Processor within the following periods:
(1) The data carriers and data sets provided shall remain the property of the Controller.
(2) Upon completion of the contractually agreed services, or earlier upon request by the Controller, but no later than upon termination of the Service Agreement, the Processor shall hand over to the Controller all documents that have come into its possession, processing and usage results created, and data holdings (including any copies or reproductions made thereof) related to the contractual relationship, or destroy them in a data-protection-compliant manner with the Controller's prior consent. The same applies to test and reject material. A deletion record shall be provided to the Controller upon request.
(3) The Processor may retain documentation serving as evidence of processing in accordance with the instructions and in a proper manner beyond the end of the Agreement until the expiry of the applicable retention periods. Alternatively, the Processor may hand it over to the Controller upon termination of the Agreement for the purpose of discharging itself from its obligations. After expiry of the retention period, the obligations set out in paragraph 2 shall apply to the data retained pursuant to sentence 1.
pursuant to Art. 28(3)(c) and Art. 32 GDPR in conjunction with Art. 5(1) and (2) GDPR
Unauthorised persons must be denied access to the technical facilities used by the Processor to provide the services assigned to it.
Measures implemented by the Processor:
| Use of an access control system (key-based access systems) |
| Use of an alarm system |
| Documentation of the issue of keys or RFID access cards |
| Everyone knows everyone (SME) |
| Access authorisation structure is limited to what is strictly necessary |
It must be ensured that the facilities (hardware, operating systems, software) required to provide the IT services described cannot be used by unauthorised persons.
Measures implemented by the Processor:
| Automatic locking of PCs/Macs after x minutes |
| Use of personalised logins on the company network |
| Use of secure and individual passwords |
| Two-factor authentication |
| Assignment of user permissions |
| Use of anti-virus software |
| Use of a hardware/software firewall |
It must be ensured that persons authorised to use a data processing system can access only the data covered by their access authorisation, and that personal data cannot be read, copied or altered without authorisation during processing, use or after storage.
Measures implemented by the Processor:
| Documentation of access accounts set up for employees |
| Introduction of user and role concepts for internal systems |
| Authorisation concepts and access rights based on need |
| Blocking of access accounts when employees leave |
| Central management of user accounts and permissions |
It must be ensured that personal data cannot be read, copied, altered or removed without authorisation during electronic transmission, transport or storage on data carriers, and that it is possible to verify and establish the points at which the transmission of personal data is intended to take place by means of data transmission facilities.
Measures implemented by the Processor:
| Use of SSL-encrypted transmission channels on the Internet |
| Protection of documents when sent by post (e.g. opaque mailing envelopes) |
| Use of VPN systems to log in to the company network |
It must be ensured that data collected for different purposes can be processed separately.
Measures implemented by the Processor:
| Introduction of access permissions for internal systems |
| Separation of internal Wi-Fi and guest Wi-Fi |
| Separation of live and development systems |
Personal data should be processed in such a way as to prevent its accidental or unlawful disclosure or unauthorised disclosure. Encryption mechanisms that are considered secure and reflect the state of the art are used for this purpose.
Measures implemented by the Processor:
| Use of encrypted transmission channels for data exchange |
| Use of SSL certificates for hosting environments |
It must be possible to subsequently verify and establish whether and by whom personal data has been entered into, modified in or removed from data processing systems.
Measures implemented by the Processor:
| Introduction of user and role concepts for internal systems |
| Introduction of individual access accounts for internal systems |
| Logging of access to the company network |
| Use of personalised logins on the company network |
The measures for data transfer control under section 1.4 also serve to ensure integrity.
Measures must be taken to protect personal data against accidental destruction or loss.
Measures implemented by the Processor:
| Conducting code reviews during development |
| Preparing code documentation during development |
| Using testing procedures (e.g. unit tests) during development |
| Using version control (e.g. Git or SVN) during development |
| Regularly updating virus definitions |
| Regularly performing data backups |
| Regularly installing updates (Windows, Mac, Linux, desktop applications) |
| Use of a firewall |
| Use of a virus scanner |
| Use of surge protection for internal systems |
| Use of RAID systems |
Measures must be taken to ensure that the availability of personal data and access to it can be restored quickly in the event of a physical or technical incident.
Measures implemented by the Processor:
| Use of version control in development |
| Preparation of emergency plans for critical processes |
A procedure for regularly reviewing, assessing and evaluating data protection and the effectiveness of the established technical and organisational measures must be implemented.
Measures implemented by the Processor:
| Deletion of data that is no longer required (e.g. outdated data, test environments) |
| Secure disposal of defective or no longer required hardware |
It must be ensured that personal data processed on behalf of the Controller can be processed only in accordance with the Controller's instructions.
Measures implemented by the Processor:
| Conclusion of data processing agreements with service providers, partners and customers |
| Selection of suitable service providers and partners with regard to data protection |
| Engagement of certified service providers (e.g. TÜV-certified hosting) |
| Appointment of a Data Protection Officer (from 10 persons) |
| Advising/informing customers on data protection |
| Communication of data protection codes of conduct to all employees |
| Regular data protection training and further education for employees |
| Signing of a confidentiality agreement by all employees |
| Sub-processor | Description |
|---|---|
| Amazon Web Services EMEA SARL (DE) | Detco Apps may use Amazon Web Services (AWS) as infrastructure. Personal data is stored and processed on AWS servers. In addition, Detco uses Amazon SES (Simple Email Service) to send emails (e.g. booking confirmations) to guests of our customers. |
| Hetzner Online GmbH (DE) | Detco Apps may use Hetzner as infrastructure. Personal data is stored and processed on Hetzner servers. |
| Adyen N.V. (NL) | Detco uses Adyen's payment services to process payments on behalf of our customers from their guests. For this purpose, we transfer payment method data (credit cards or information about other payment methods such as PayPal, Klarna or other providers) to Adyen N.V. |
| Apaleo GmbH | Apaleo GmbH is a PMS (Property Management System) to which personal booking data is transferred so that the Controller can continue working with it there. |
| Zendesk, Inc. (US) | Detco uses Zendesk Support and Zendesk Guide to provide users with support and documentation. Personal data is stored and processed by Zendesk, Inc. for this purpose. |
| Functional Software Inc. (US) | Detco uses sentry.io to track and monitor errors and issues arising when using various apps. Personal data is stored and processed by Functional Software Inc. for this purpose. |
| hundertzehn GmbH (DE) | Detco uses moco to record Controller data and create invoices. Personal data is stored and processed by hundertzehn GmbH for this purpose. |
| Stayntouch, Inc. (US) | Stayntouch is a PMS (Property Management System) to which personal booking data is transferred so that the Controller can continue working with it there. |
| Shiji Israel LTD (ISR) | Detco uses myCheck payment services to process payments on behalf of our customers from their guests. For this purpose, we transfer payment method data (credit cards or information about other payment methods such as PayPal, Klarna or other providers) to Shiji Israel LTD. |
| Mailjet GmbH (DE) | Detco uses Mailjet to send emails (e.g. booking confirmations) to our customers' guests. Personal data is stored and processed by Mailjet GmbH for this purpose. |
| The Rocket Science Group LLC (US) | For certain apps, Detco offers the option of connecting to MailChimp. Personal data is stored and processed by The Rocket Science Group for this purpose. |
| Feratel media technologies AG (AT) | Feratel provides an interface for processing registration forms. Personal data is stored and processed by Feratel media technologies AG so that the Controller can continue working with it there. |
| myIBE | myProfile Manager |
myGuest Mailing |
myTraces | Expedia Direct Connect | HRS Direct Connect | Google Connect | Feratel Connect | |
|---|---|---|---|---|---|---|---|---|
| Amazon Web Services EMEA SARL (DE) | X | |||||||
| Hetzner Online GmbH (DE) | X | X | X | X | X | X | X | |
| Adyen N.V. (NL) | (x)* | |||||||
| Apaleo GmbH | (x)* | (x)* | (x)* | (x)* | (x)* | (x)* | (x)* | (x)* |
| Zendesk, Inc. (US) | x | |||||||
| Functional Software Inc. (US) | X | X | X | X | X | X | X | X |
| hundertzehn GmbH (DE) | X | X | X | X | X | X | X | X |
| Stayntouch, Inc. (US) | (x)* | |||||||
| Shiji Israel LTD (ISR) | (x)* | |||||||
| Mailjet GmbH (DE) | X | |||||||
| The Rocket Science Group LLC (US) | (x)* | |||||||
| Feratel media technologies AG (AT) | x |
* Where the Processor uses this service.