This list is section 5 of the Data Protection Annex, and the clause numbers below are its clause numbers.
5.1 You give general authorisation for the sub-processors below. We impose data protection obligations on each of them no less protective than this Annex, and we remain liable to you for what they do.
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Cloud (Google Cloud EMEA, Ireland) | Hosting: database, file storage, compute, secrets, logging | me-central1 (Qatar) for map content, media and application compute; europe-north1 (Finland) for the analytics warehouse; europe-west2 (London) for 3D pipeline outputs |
| Google Cloud Translation API | Machine translation of your map content, at your request | Google, under its Cloud Data Processing Addendum |
| Google Analytics 4 / Firebase | Capturing the visitor analytics that power your dashboard | Google; warehouse in europe-north1; collection may involve US transfer |
| Vercel Inc. | Front-end hosting and server-side rendering | US company; functions pinned to Frankfurt (fra1), EEA |
| Cloudflare, Inc. | DNS, TLS and CDN for certain hostnames | Global edge network |
| Postmark (ActiveCampaign) | Transactional email — HypaFlow sign-in passcodes and notifications | United States |
5.2 We will give you at least 30 days’ notice before adding or replacing a sub-processor. You may object on reasonable, documented data-protection grounds within that period; we will work with you in good faith, and if we cannot resolve it you may terminate the affected service and get back what you have prepaid for the unused period.