Home · Legal Notices · Subprocessors
Approved Subprocessors
Annex C to the Data Processing Agreement (DPA) of beUnity AG
Note: This English translation is provided for convenience only. The legally binding version is the German original.
beUnity Platform
Version: 1.5, dated: 18 July 2025
Note: All providers listed below are used in accordance with the requirements of the GDPR and the revised Swiss Data Protection Act (revFADP). Contractual data processing agreements (Art. 28 GDPR) are in place in each case.
| Name | Country of data processing | Description | Data concerned |
|---|---|---|---|
| Exoscale | Switzerland and Germany | Hosting and encrypted storage of all platform data in Swiss data centres. | All data |
| Amazon Web Services | Switzerland and Germany | Web service for hosting images and attachments, stored in encrypted form in a German data centre. | Attachments, images |
| Firebase | USA | Supports the development and stability of the mobile and web application (e.g. performance monitoring, crash reporting). | Device IDs, error messages (no personal user data) |
| Pusher | EU (Ireland) | Dispatch of push notifications (e.g. via web or mobile app). | Device IDs, push messages (no personal user data) |
| SendGrid | USA | Dispatch of notifications, summaries and newsletters by e-mail as part of beUnity communication. | E-mail addresses, dispatch content |
| Sentry | Germany | Error tracking and monitoring of the platform for quality assurance. | No attributable user data, platform and system error logs |
| Twilio | USA | Dispatch of SMS as part of two-factor authentication (2FA). | Telephone numbers (for SMS dispatch in the context of 2FA) - no attributable user data |
| Fastly | EU | CDN (content delivery network) for performance optimisation. | Attachments, images |
| Lingohub | EU (Ireland) | Cloud service for managing and translating system and UI texts of the platform. | No personal data – only static texts and strings of the platform (e.g. navigation etc.) |
beUnity websites
Dated: 2026-06-11
Note: All providers listed below are used in accordance with the requirements of the GDPR and the revised Swiss Data Protection Act (revFADP).
| Name | Country of data processing | Description | Data concerned |
|---|---|---|---|
| CookieYes | United Kingdom; data stored in EU data centres | Consent management: cookie banner and proof of consent (consent log). | Consent status, pseudonymised IP address, country, timestamp |
| Vercel | USA (EU standard contractual clauses) | Hosting and worldwide delivery (CDN) of the marketing website. | Technical access data (e.g. IP address, browser) |
| Strapi Cloud | Hosting region currently being verified | Hosting of the content management system for the website content. | No user data, only editorial website content |
| PostHog | EU (Frankfurt, Germany) | Anonymised web analytics and event tracking (EU Cloud). | Anonymised usage data (no attributable user data) |
| HubSpot | USA (EU standard contractual clauses) | Forms (contact, newsletter, trial) and CRM. | Form entries (name, e-mail address, voluntary details) |
| YouTube (Google) | USA | Embedding of videos on individual pages. | Technical access data when playing embedded videos |
The list of our subprocessors (including name, location of data processing and purpose) is publicly available on this page. We provide further technical details or contractual documents upon legitimate request.