Draft for review. Not reviewed by a lawyer, and not in force. What is undecided, or does not exist yet, is marked like this: [ADDRESS]
Sub-processors and other recipients
Who handles personal data for Adcato, what each one gets, where, and on what basis. It is Annex 3 of the data processing agreement.
Version 2026-11-15.draft2
What this list is
We handle some personal data for agencies, as their processor: the records an agency keeps in Adcato about its clients. [ROLES TO BE CONFIRMED IN LEGAL REVIEW; SEE THE PRIVACY POLICY, SECTION 2]
GDPR Article 28(2) says a processor may engage another processor only with the controller’s prior specific or general written authorisation. With a general authorisation, the processor must tell the controller about any intended addition or replacement, so that the controller can object.
- The data processing agreement (clause 7) gives a general authorisation for the providers in section 1, and for those in section 3 once they are chosen.
- We tell every agency owner by email at least [30] days before we add or replace a sub-processor. An agency that objects can end the agreement before the change takes effect (clause 7.4 of the agreement).
- Meta’s Platform Terms (section 5.a) require every service provider that handles data from Facebook to agree in writing to process it only for us and at our direction. The agreements with Hetzner and with the mail provider must carry that. [OWNER: CHECK BOTH AGREEMENTS FOR IT]
The list also names the providers we use for our own processing (billing, our own mail and marketing), and the recipients that are not sub-processors, so that one page answers who gets personal data.
1. Sub-processors in use
| Item | Hetzner |
|---|---|
| Provider | Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany |
| What it does for us | Rents us the server that runs everything: the application, the database, the sign-in service, the job worker and the mail queue |
| Personal data it handles | Everything the service stores (privacy policy, section 3): agency accounts, client session records and encrypted tokens, the activity log, the mail queue, reports of requests |
| Where | Finland (EU) [CONFIRM THE HETZNER LOCATION OF THE SERVER] |
| Transfer outside the EEA | None. Hetzner says data on servers in its EU locations, Helsinki among them, is stored and processed in the EU |
| Agreement | Hetzner’s data processing agreement under Article 28, concluded in the Hetzner customer account (Hetzner does not sign individual ones). [OWNER: CONFIRM IT IS CONCLUDED, AND IN THE NAME OF THE COMPANY THAT RUNS THIS SERVICE. THE SERVER IS RENTED ON AN ACCOUNT THAT ALSO RUNS ANOTHER PRODUCT] |
2. Chosen, not switched on yet
| Item | Stripe |
|---|---|
| Provider | Stripe [STRIPE ENTITY NAMED IN THE OWNER'S STRIPE AGREEMENT] |
| What it does for us | Billing: Checkout, the customer portal, invoices, and the payment events Stripe sends us |
| Personal data | The paying agency’s billing details and card details, entered on Stripe’s own pages (we never see the card). From us: the agency’s name, the email address of the owner who chooses a plan, the agency’s ID and the owner’s language. If VAT is collected at checkout, Stripe also collects the billing address, the legal name and the VAT number |
| Where | Stripe’s data processing agreement says personal data goes to Stripe, LLC in the United States, and may go to Stripe’s affiliates and sub-processors (stripe.com/legal/service-providers) |
| Transfer basis | The EU-U.S. Data Privacy Framework, which Stripe’s addendum relies on first. If that falls away, the EEA standard contractual clauses in Stripe’s data transfers addendum |
| Agreement | Stripe’s data processing agreement and data transfers addendum, part of Stripe’s services agreement |
Stripe is our processor for our own billing of agencies, where we are the controller. It never receives the data we hold for agencies about their clients. For some purposes, such as preventing fraud and meeting anti-money-laundering rules, Stripe is a controller in its own right (its data processing agreement, section 2).
3. Not chosen yet
| Provider | What it would do | Personal data |
|---|---|---|
| [MAIL PROVIDER] | Sends every mail the service sends (SMTP) | The recipient’s address, the sender, the subject, and the text of the mail with its one link to our site. Recipients today: agency people, invited colleagues and our staff. No mail goes to clients today. A mail about a client (“finished”, “stuck”) names the client as the dashboard does; when the agency left the name empty, that name was taken from the client’s Business Manager or account, so it is data that came from Meta or Google |
| [SUPPORT AND ABUSE MAILBOX PROVIDER] | Receives mail to support@adcato.com and abuse@adcato.com | Whatever people write to us, and their address |
| [BACKUP STORAGE] | Keeps copies of the database away from the server | A copy of everything in the database |
| [WHERE THE CONTACT LIST IS KEPT] | Holds the list of agencies we contact about the service (privacy policy, section 3.5). Our own marketing, not data we hold for agencies | Agency names and websites, shared addresses, contact persons who wrote back, notes and the block list |
For each of them: [WHERE IT IS, THE TRANSFER BASIS IF IT IS OUTSIDE THE EEA, AND ITS DATA PROCESSING AGREEMENT: ADDED WHEN IT IS CHOSEN]
4. Recipients that are not sub-processors
These receive personal data, but do not process it for us.
| Recipient | What it receives, and when | Role |
|---|---|---|
| Meta [META PLATFORMS IRELAND LIMITED, TO BE CONFIRMED AS THE CONTRACTING ENTITY FOR THE APP] | Our calls to its API with the signed-in person’s own token: reading what the person can share, giving the agency’s business access on the client’s click, revoking the token when the session ends. Meta sends us data deletion and deauthorize requests | Its own controller, under its own terms. Meta’s Platform Terms name Meta Platforms Ireland Limited as the controller of the data it holds about people in the EEA. Their section 10A (transfers of that data to a country outside the EEA without an adequacy decision) does not apply while the data stays in the EEA. It would apply if the mail provider (section 3) were outside the EEA in such a country, because a mail about a client can carry a name taken from the client’s Business Manager |
| Google [GOOGLE ENTITY: TO BE CONFIRMED FROM THE GOOGLE APIS TERMS] | Our calls to its sign-in, Google Ads, Analytics Admin and Tag Manager APIs with the signed-in person’s own token, and revocation. When a client gives access, the agency’s Google address (privacy policy, section 3.1) | Its own controller, under its own terms |
| The agency that sent a link | The status of each client, the accounts the client chose, and what access was given | Controller of its own client records |
| Stripe, for its own purposes | See section 2 | Its own controller for those purposes |
| Authorities | Where the law requires it |
Not used: the service calls no analytics, advertising, error-reporting, chat or content-delivery service. Its only outside connections are to Meta, Google, an SMTP server, (when billing is switched on) Stripe, and DNS look-ups of an agency’s own link domain through the server’s resolver. The host’s web server gets the TLS certificates for our domain and, once custom domains are switched on, for agencies’ link domains from a certificate authority [WHICH CERTIFICATE AUTHORITY: CONFIRM IN THE HOST CONFIGURATION]. Neither of these carries personal data beyond a domain name.
5. Changes to this list
| Date | Change |
|---|---|
| 14 November 2026 | First draft |
Agencies are told about a change as “What this list is” says, above.