Translation. The Hungarian version (Alvállalkozók) is the binding text.
In short. By default we store and process customer data in the European Union: hosting is on Hetzner infrastructure in Germany and the AI functions use Mistral AI SAS in France. By default there is no transfer outside the EEA. Processing outside the EEA is possible only where the customer itself switches on such a service (its own AI key, or an account it connects).
This is the full version of Annex III of the Data Processing Agreement (GDPR Art. 28(2)).
Operations and hosting
| Provider | Function | Location | Transfer basis |
|---|---|---|---|
| Hetzner Online GmbH - web hosting | Running the application and the database; sending transactional e-mail from our own mail server | Germany (EEA) | EEA, no transfer mechanism needed |
| Hetzner Online GmbH - Hetzner Cloud server | Mail monitoring and keeping the copy of the daily backup (each database is copied daily and the copy is pulled to this server) | Nuremberg, Germany (EEA) | EEA, no transfer mechanism needed |
| Cloudflare, Inc. | DNS, CDN/proxy, DDoS protection | EU network nodes; the parent company is in the USA | Standard contractual clauses (SCC, module 3) and Cloudflare’s data processing addendum |
Artificial intelligence
| Provider | Function | Location | Transfer basis |
|---|---|---|---|
| Mistral AI SAS | The default AI processor for customer data: chat and tool use, classification, document OCR and vision, embeddings | France (EEA) | EEA, no transfer mechanism needed |
No other AI provider receives customer data by default. If Mistral is temporarily unavailable the system currently does not switch to another provider but shows a "temporarily unavailable" message (no fallback provider is configured). NVIDIA is not an eligible provider for customer data, so we do not use it for that. Anthropic, Google (Gemini) and other providers named by the customer can receive data only on the route below, with the customer’s own key.
The customer’s own AI key
The customer may add its own AI provider key. The data is then processed by that provider under the customer’s own contract. If the provider’s endpoint is outside the EU, the platform uses the key only after the customer’s explicit, recorded acceptance, naming the provider and endpoint; the acceptance can be withdrawn at any time, and without acceptance (or after withdrawal) the data stays on the EU (Mistral) route. The customer is responsible for the legal consequences of processing outside the EU after it has accepted.
Payment
| Provider | Function | Location | Transfer basis |
|---|---|---|---|
| Revolut Bank UAB | Card collection of the subscription fee, recurring charges | Lithuania (EEA) | EEA |
Services the customer connects
These receive data only if the customer itself switches on and authorises the integration; each is governed by its own terms and the safeguards below.
| Provider | Function | Location | Transfer basis |
|---|---|---|---|
| Google LLC | Connecting Gmail, Google Calendar, Google Drive (scopes in the Privacy Notice) | USA | EU-US Data Privacy Framework (where certified) and/or SCC; Google Workspace terms |
| Microsoft Ireland Operations Ltd. | Microsoft 365 (Outlook, calendar, Teams) | Ireland (EEA); partly USA | SCC; Microsoft data processing terms |
| Meta Platforms Ireland Ltd. | WhatsApp Business, Facebook, Instagram | Ireland (EEA); partly USA | SCC; Meta platform terms |
| Twilio Ireland Ltd. | Sending and receiving SMS | Ireland (EEA) | EEA; Twilio DPA |
| LinkedIn Ireland Unlimited Company | Social publishing | Ireland (EEA); partly USA | SCC; LinkedIn terms |
Optional features
These receive data only if the customer uses the feature concerned.
| Provider | Function | Location | Transfer basis |
|---|---|---|---|
| Recall.ai | Meeting note-taking bot (joins video meetings); EU region configured | EU region | The provider’s data processing terms; details on request |
| ElevenLabs | Voice synthesis (the text to be spoken is passed on) | As set by the provider; may be outside the EEA | The provider’s data processing terms; details on request |
Authority (not a processor)
The NAV (Hungarian tax authority) is not our sub-processor but an authority: we carry out the customer’s statutory invoice reporting into the NAV systems on the customer’s instruction and in its name. The NAV is an independent controller of the data it receives.
Changes
We notify active customers by e-mail at least 30 days before a new or replacement sub-processor starts. The customer may object in that period; if we cannot accommodate the objection it may terminate the affected service and we refund the unused period pro rata (DPA section 6). Questions, or a copy of the SCC in force: [email protected].