Data Processing Agreement
This Data Processing Agreement (DPA) describes the processing of personal card data by palmstudio GmbH for business customers of DigiVisitenkarte and DigiCard Pro. It comprises the following Standard Contractual Clauses and all Annexes.
1. Scope and contractual basis
We offer this DPA and all its Annexes as a binding part of our Terms of Service. It is concluded with the controller identified in Annex I when that controller validly accepts the Terms during registration or ordering, including through an authorised representative. No separate signature, additional form or further acceptance by us is required. Publication alone, card content or earlier acceptance of different Terms does not conclude this DPA. The agreement does not apply retroactively to earlier processing.
The DPA applies insofar as the customer acts as controller and instructs us to process personal data on its behalf. Its application does not depend on card variant, quantity, group features or account type. Private use solely of one's own data does not in itself establish such processing on behalf of a controller. Where a customer itself acts as a processor, authorisation by the actual controller and the necessary further agreements must be addressed separately before processing.
The controller determines the data subjects, permitted card content, recipients and publication. It is responsible for the lawful basis, required information and any necessary consents, particularly for photographs and public card URLs. We are responsible for our own duties as processor, including processing on instructions, confidentiality, security and assistance. This DPA does not transfer our statutory duties to the controller.
We use the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/915. The choices are the GDPR options (Option 1 in Clauses 1, 8 and 9), general written authorisation in Clause 7.7(a) with 30 days' advance notice (Option 2), and omission of the optional docking clause, Clause 5. The remaining clause wording is unchanged. The completed Annexes specify the service. The Standard Contractual Clauses prevail in the event of conflict, including over liability or other provisions in our Terms of Service.
These Clauses govern processing under Article 28 GDPR. They do not by themselves establish a lawful basis for international transfers. The additional transfer arrangements are described in Annex IV and must be in place for the services actually used.
2. Standard Contractual Clauses
SECTION I
Clause 1 - Purpose and scope
(a) The purpose of these Standard Contractual Clauses (the Clauses) is to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
(b) The controllers and processors listed in Annex I have agreed to these Clauses in order to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 and/or Article 29 (3) and (4) Regulation (EU) 2018/1725.
(c) These Clauses apply to the processing of personal data as specified in Annex II.
(d) Annexes I to IV are an integral part of the Clauses.
(e) These Clauses are without prejudice to obligations to which the controller is subject by virtue of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.
(f) These Clauses do not by themselves ensure compliance with obligations related to international transfers in accordance with Chapter V of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.
Clause 2 - Invariability of the Clauses
(a) The Parties undertake not to modify the Clauses, except for adding information to the Annexes or updating information in them.
(b) This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a broader contract, or from adding other clauses or additional safeguards provided that they do not directly or indirectly contradict the Clauses or detract from the fundamental rights or freedoms of data subjects.
Clause 3 - Interpretation
(a) Where these Clauses use the terms defined in Regulation (EU) 2016/679 or Regulation (EU) 2018/1725 respectively, those terms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679 or Regulation (EU) 2018/1725 respectively.
(c) These Clauses shall not be interpreted in a way that runs counter to the rights and obligations provided for in Regulation (EU) 2016/679 / Regulation (EU) 2018/1725 or in a way that prejudices the fundamental rights or freedoms of the data subjects.
Clause 4 - Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties existing at the time when these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 6 - Description of processing(s)
The details of the processing operations, in particular the categories of personal data and the purposes of processing for which the personal data is processed on behalf of the controller, are specified in Annex II.
Clause7 - Obligations of the Parties
7.1. Instructions
(a) The processor shall process personal data only on documented instructions from the controller, unless required to do so by Union or Member State law to which the processor is subject. In this case, the processor shall inform the controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. Subsequent instructions may also be given by the controller throughout the duration of the processing of personal data. These instructions shall always be documented.
(b) The processor shall immediately inform the controller if, in the processor’s opinion, instructions given by the controller infringe Regulation (EU) 2016/679 / Regulation (EU) 2018/1725 or the applicable Union or Member State data protection provisions.
7.2. Purpose limitation
The processor shall process the personal data only for the specific purpose(s) of the processing, as set out in Annex II, unless it receives further instructions from the controller.
7.3. Duration of the processing of personal data
Processing by the processor shall only take place for the duration specified in Annex II.
7.4. Security of processing
(a) The processor shall at least implement the technical and organisational measures specified in Annex III to ensure the security of the personal data. This includes protecting the data against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to the data (personal data breach). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks involved for the data subjects.
(b) The processor shall grant access to the personal data undergoing processing to members of its personnel only to the extent strictly necessary for implementing, managing and monitoring of the contract. The processor shall ensure that persons authorised to process the personal data received have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
7.5. Sensitive data
If the processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (“sensitive data”), the processor shall apply specific restrictions and/or additional safeguards.
7.6 Documentation and compliance
(a) The Parties shall be able to demonstrate compliance with these Clauses.
(b) The processor shall deal promptly and adequately with inquiries from the controller about the processing of data in accordance with these Clauses.
(c) The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations that are set out in these Clauses and stem directly from Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725. At the controller’s request, the processor shall also permit and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or an audit, the controller may take into account relevant certifications held by the processor.
(d) The controller may choose to conduct the audit by itself or mandate an independent auditor. Audits may also include inspections at the premises or physical facilities of the processor and shall, where appropriate, be carried out with reasonable notice.
(e) The Parties shall make the information referred to in this Clause, including the results of any audits, available to the competent supervisory authority/ies on request.
7.7. Use of sub-processors
(a) The processor has the controller’s general authorisation for the engagement of sub-processors from an agreed list. The processor shall specifically inform in writing the controller of any intended changes of that list through the addition or replacement of sub-processors at least 30 days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the concerned sub-processor(s). The processor shall provide the controller with the information necessary to enable the controller to exercise the right to object.
(b) Where the processor engages a sub-processor for carrying out specific processing activities (on behalf of the controller), it shall do so by way of a contract which imposes on the sub-processor, in substance, the same data protection obligations as the ones imposed on the data processor in accordance with these Clauses. The processor shall ensure that the sub-processor complies with the obligations to which the processor is subject pursuant to these Clauses and to Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.
(c) At the controller’s request, the processor shall provide a copy of such a sub-processor agreement and any subsequent amendments to the controller. To the extent necessary to protect business secret or other confidential information, including personal data, the processor may redact the text of the agreement prior to sharing the copy.
(d) The processor shall remain fully responsible to the controller for the performance of the sub-processor’s obligations in accordance with its contract with the processor. The processor shall notify the controller of any failure by the sub-processor to fulfil its contractual obligations.
(e) The processor shall agree a third party beneficiary clause with the sub-processor whereby - in the event the processor has factually disappeared, ceased to exist in law or has become insolvent - the controller shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.
7.8. International transfers
(a) Any transfer of data to a third country or an international organisation by the processor shall be done only on the basis of documented instructions from the controller or in order to fulfil a specific requirement under Union or Member State law to which the processor is subject and shall take place in compliance with Chapter V of Regulation (EU) 2016/679 or Regulation (EU) 2018/1725.
(b) The controller agrees that where the processor engages a sub-processor in accordance with Clause 7.7. for carrying out specific processing activities (on behalf of the controller) and those processing activities involve a transfer of personal data within the meaning of Chapter V of Regulation (EU) 2016/679, the processor and the sub-processor can ensure compliance with Chapter V of Regulation (EU) 2016/679 by using standard contractual clauses adopted by the Commission in accordance with of Article 46(2) of Regulation (EU) 2016/679, provided the conditions for the use of those standard contractual clauses are met.
Clause 8 - Assistance to the controller
(a) The processor shall promptly notify the controller of any request it has received from the data subject. It shall not respond to the request itself, unless authorised to do so by the controller.
(b) The processor shall assist the controller in fulfilling its obligations to respond to data subjects’ requests to exercise their rights, taking into account the nature of the processing. In fulfilling its obligations in accordance with (a) and (b), the processor shall comply with the controller’s instructions
(c) In addition to the processor’s obligation to assist the controller pursuant to Clause 8(b), the processor shall furthermore assist the controller in ensuring compliance with the following obligations, taking into account the nature of the data processing and the information available to the processor:
(1) the obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a ‘data protection impact assessment’) where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;
(2) the obligation to consult the competent supervisory authority/ies prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk;
(3) the obligation to ensure that personal data is accurate and up to date, by informing the controller without delay if the processor becomes aware that the personal data it is processing is inaccurate or has become outdated;
(4) the obligations in Article 32 Regulation (EU) 2016/679.
(d) The Parties shall set out in Annex III the appropriate technical and organisational measures by which the processor is required to assist the controller in the application of this Clause as well as the scope and the extent of the assistance required.
Clause 9 - Notification of personal data breach
In the event of a personal data breach, the processor shall cooperate with and assist the controller for the controller to comply with its obligations under Articles 33 and 34 Regulation (EU) 2016/679 or under Articles 34 and 35 Regulation (EU) 2018/1725, where applicable, taking into account the nature of processing and the information available to the processor.
9.1 Data breach concerning data processed by the controller
In the event of a personal data breach concerning data processed by the controller, the processor shall assist the controller:
(a) in notifying the personal data breach to the competent supervisory authority/ies, without undue delay after the controller has become aware of it, where relevant/(unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons);
(b) in obtaining the following information which, pursuant to Article 33(3) Regulation (EU) 2016/679, shall be stated in the controller’s notification, and must at least include:
(1) the nature of the personal data including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
(2) the likely consequences of the personal data breach;
(3) the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
(c) in complying, pursuant to Article 34 Regulation (EU) 2016/679, with the obligation to communicate without undue delay the personal data breach to the data subject, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.
9.2 Data breach concerning data processed by the processor
In the event of a personal data breach concerning data processed by the processor, the processor shall notify the controller without undue delay after the processor having become aware of the breach. Such notification shall contain, at least:
(a) a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and data records concerned);
(b) the details of a contact point where more information concerning the personal data breach can be obtained;
(c) its likely consequences and the measures taken or proposed to be taken to address the breach, including to mitigate its possible adverse effects.
Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
The Parties shall set out in Annex III all other elements to be provided by the processor when assisting the controller in the compliance with the controller’s obligations under Articles 33 and 34 of Regulation (EU) 2016/679.
SECTION III – FINAL PROVISIONS
Clause 10 - Non-compliance with the Clauses and termination
(a) Without prejudice to any provisions of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725, in the event that the processor is in breach of its obligations under these Clauses, the controller may instruct the processor to suspend the processing of personal data until the latter complies with these Clauses or the contract is terminated. The processor shall promptly inform the controller in case it is unable to comply with these Clauses, for whatever reason.
(b) The controller shall be entitled to terminate the contract insofar as it concerns processing of personal data in accordance with these Clauses if:
(1) the processing of personal data by the processor has been suspended by the controller pursuant to point (a) and if compliance with these Clauses is not restored within a reasonable time and in any event within one month following suspension;
(2) the processor is in substantial or persistent breach of these Clauses or its obligations under Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725;
(3) the processor fails to comply with a binding decision of a competent court or the competent supervisory authority/ies regarding its obligations pursuant to these Clauses or to Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.
(c) The processor shall be entitled to terminate the contract insofar as it concerns processing of personal data under these Clauses where, after having informed the controller that its instructions infringe applicable legal requirements in accordance with Clause 7.1 (b), the controller insists on compliance with the instructions.
(d) Following termination of the contract, the processor shall, at the choice of the controller, delete all personal data processed on behalf of the controller and certify to the controller that it has done so, or, return all the personal data to the controller and delete existing copies unless Union or Member State law requires storage of the personal data. Until the data is deleted or returned, the processor shall continue to ensure compliance with these Clauses.
3. Annex I - List of parties
Controller
The controller is the company, organisation or sole trader on whose behalf the accepting user actually and openly acts. Its legal name and address are identified through the associated order and billing details; the linked account or order contact details identify the acting contact person. Those details, together with the associated time of acceptance and the version offered at that time, complete this Annex without a separate business form. The existing registration, order and invoice records together with the dated agreement provide the contract record. Where the payer differs, the actual represented customer remains the relevant party; unclear identification must be resolved before processing. Card content or a group name alone does not make an entity the controller. The user must hold the necessary authority; acceptance does not create it.
Instructions may be given by the authorised persons named in the contract record or subsequently designated with a record of that designation. Verified actions within their respective card and group permissions constitute documented instructions for the relevant function. Further instructions may be sent in text form to our data protection contact; where authority is uncertain, we verify it before acting.
Processor
palmstudio GmbH, Pfalzgrafenstraße 38, 67434 Neustadt an der Weinstraße, Germany. Commercial register: Amtsgericht Ludwigshafen am Rhein, HRB 69525. Represented by managing director Benedikt Falkenstein. Brands: DigiVisitenkarte and DigiCard Pro.
Contact for data protection, instructions and incidents: support@digivisitenkarte.de or support@digicard.pro. The processor's contact is its management; use of this functional address does not assert that an external data protection officer has been appointed.
The agreement is concluded electronically as described in Section 1; its date follows the associated acceptance of the Terms. Later changes to this published page do not automatically amend a previously agreed version.
4. Annex II - Description of the processing
Subject matter, nature and purpose
Provision and management of digital business cards according to the controller's settings: receiving entries and import data, storage, applying group or template defaults, processing images, creating and updating Wallet files or objects, QR codes and contact exports, providing online business cards and photo contact downloads, and requested card delivery by email. This includes the necessary authorisation checks, task processing, technical troubleshooting and erasure.
Processing is automated and, where necessary for an authorised support request, instruction or incident resolution, performed by authorised persons. We do not use card content processed on behalf of the controller for our own advertising, training AI models or building our own contact directories.
Data subjects and data
Data subjects are employees, management, representatives and other persons lawfully identified on a card by the controller, and the card-delivery recipients it selects.
Data consists of the names, titles, professional roles, company affiliations, email addresses, telephone numbers, business addresses, websites, social media identifiers and links, notes, short descriptions, link labels, photographs, cover images and any personal logos actually supplied. It also includes group assignments, card and asset references, design and QR settings, change and delivery status, authorisation-related assignments, and technical data necessary for delivery and troubleshooting. Enabled Wallet updates may involve pass and object identifiers, Apple device registrations and push tokens. Optional location settings describe the relevance locations set by the controller; continuous employee location tracking is not a feature of the service.
Special categories under Article 9 GDPR and criminal-offence data under Article 10 GDPR are outside the agreed standard service and must not intentionally be supplied. Ordinary profile photographs are not analysed for biometric identification. If either party nevertheless discovers sensitive content, it informs the other and promptly addresses restriction or removal and any necessary additional safeguards; Clause 7.5 remains applicable.
Publication, recipients and instructions
The requested card, group, import, image, export and delivery functions form the agreed scope of instructions. An offline vCard QR code contains contact details directly. Online business cards, photo contact links and image URLs intended for Wallet display can be accessed by persons holding the relevant address. Choosing a different QR target does not automatically make those URLs private. Search engines are asked not to index online business cards; this is not an access restriction.
The controller instructs the selected publication, delivery and transmission to Wallet providers and must inform the persons concerned. Recipients may store or share data beyond our control. Contacts already imported, downloaded passes, screenshots, and copies in Wallets or recipients' systems cannot reliably be recalled by deleting data in our system. We assist with removal or updates possible within our systems; third parties' own duties remain unaffected.
Duration, return and erasure
Processing begins only on the basis of an effective instruction and agreement including this DPA, and continues as necessary for the commissioned use and its winding down. Product duration is governed by the applicable main agreement; the DPA creates no additional hosting or lifetime promise. On termination or an appropriate authorised instruction, we either return the data in an available commonly used format and erase our remaining copies, or erase it directly, at the controller's choice. Erasure is certified. Legally required retention and Clause 10(d) remain unaffected; retained data is restricted to that purpose.
In normal technical operation, photo QR previews become inaccessible after no more than 60 minutes. Associated cleanup runs every 15 minutes; failed deletions are retried. Completed technical background workflows and their delivery jobs are normally subject to daily cleanup after 40 days. These periods do not grant a blanket right to retain data contrary to an effective erasure instruction. Active cards and their required images are not removed merely because time has passed. Erasure instructions include a review of replaced images, old Google Wallet image variants, delivery events and recovery copies to determine what remains necessary and what must be removed.
Legally required retention of our own invoice, contract or evidential records is handled separately from further use of employee card content. Where immediate selective erasure from backups is technically impossible, those copies remain isolated from ordinary use, expire under their deletion cycle, and have previously instructed deletions reapplied if restored. This does not authorise indefinite backup retention.
Our own purposes and other recipients
Our own user accounts, business relationships, payment and tax processing, legal claims, and our own website analytics and advertising are handled under the Privacy Policy, rather than as unrestricted business-customer instructions, insofar as we determine their purposes ourselves. This distinction does not authorise repurposing the employee card content entrusted to us. Dodo Payments is an independent controller for its seller and payment activities. Apple and Google operate their own Wallet, device and account services under the relevant terms; this does not make them blanket sub-processors under this DPA. Our instructed technical creation and transmission remain part of our service. Ordinary email providers of recipients selected by the controller are not sub-processors engaged by us.
5. Annex III - Technical and organisational measures
The following measures concern the processing in Annex II. They must be distinguished from infrastructure providers' certifications and measures; we do not claim our own ISO or SOC certification. Measures may evolve while providing at least equivalent protection. This does not permit a material reduction in protection.
Access, authorisation and separation
User identities are checked through Firebase Authentication. Server APIs verify card ownership, group or company permissions, or a purpose-specific access token as applicable. Administrator access is separately checked against an active administrator authorisation. Access is limited to authorised persons who require it for their tasks; confidentiality obligations apply before access is granted. Permissions must be updated or withdrawn on a role change or departure.
Anonymous editing, cart and distribution access use random purpose-specific credentials with the applicable expiry and revocation rules. Where the particular mechanism provides for it, only hashes of access tokens are stored. Those links must be kept confidential. Intentionally public card and download URLs are distinct from such credentials.
Production and staging databases and their associated image stores are logically separated. Server access uses the defined resource context. Database and Storage rules do not grant general public access to private cards, preview keys, orders or workflow data. Intentionally public image and card endpoints check the requirements applicable to their purpose. Administrative cloud credentials are not provided to the ordinary browser client.
Transmission, storage and keys
Public product endpoints use HTTPS. Private Cloud Storage files are delivered through authorised server access or time-limited signed image URLs where they are not expressly intended for public card output. The Google Cloud storage services used provide encryption at rest under their service terms. End-to-end encryption of permanently stored cards or keys held exclusively by the controller are not part of this service.
Temporary photo QR previews use a separate image copy, a random preview key and encrypted contact payloads. The server decrypts those payloads to generate the vCard; this does not conceal the data from our server. Preview endpoints are excluded from our application analytics processing. Infrastructure logging must be separately assessed for appropriate minimisation; we do not promise that every infrastructure provider generates no technical logs.
Integrity, operation and recovery
Shared schemas validate input and image formats. Backend authorisation checks, transactional state changes and retry-safe background tasks protect card changes, delivery and erasure against unauthorised or duplicate processing. Background jobs have retry and failure states; uncertain email delivery is not blindly repeated.
Operation relies on managed cloud infrastructure, its availability and recovery mechanisms, and documented restart and troubleshooting procedures. This DPA does not assert that an additional independent full backup of all cards, a particular backup frequency or a fixed recovery time is already established. Necessary recovery measures must be reviewed according to risk, and additional backups must be included in erasure processes where used. Physical data-centre access and associated safeguards are managed by the respective infrastructure operators.
Review, minimisation and erasure
Changes are version-controlled and checked through suitable targeted tests, particularly authorisation, inheritance, uploads, erasure and delivery retries. Protection needs, permissions, providers and effectiveness of measures must be reviewed regularly and after significant changes or incidents. Operating systems, runtimes and dependencies must be maintained according to risk. Customer content should be used for testing only where necessary, authorised and subject to the same safeguards; synthetic data is preferred.
Anonymous browser-local carts primarily contain references and access credentials rather than complete card content. The pure online business card and photo download surfaces do not load application advertising or analytics scripts. Erasure instructions take account of dependent card images, passes and references. Existing background processes handle technical cleanup and failed deletions. Operational logs and support messages must be limited to necessary information; full employee lists or image copies should not be included in support messages without a need.
Assistance, incidents and evidence
The data protection contact in Annex I receives instructions and data-subject requests. We check their association and authority, refer requests to the controller where necessary, and assist within our control with access, rectification, export, restriction and erasure. We provide available processing and security information for security assessments and any necessary data protection impact assessments. Regulatory notifications and communications to data subjects follow the legally applicable allocation of responsibilities.
Personal data breaches are notified to the controller without undue delay after awareness; incomplete information is supplemented in stages. Information includes, where known, the nature and time, affected data and groups of people, estimated scope, likely consequences, contact point, and mitigation taken or proposed. Relevant evidence is preserved and remediation and further coordination are documented. The controller's statutory notification deadline is neither transferred to us nor extended.
Evidence and reviews initially use suitable documentation and, where necessary, the audits provided for in Clause 7.6. Protection of other customers, trade secrets and operational security is taken into account without excluding contractual or statutory audit rights. Access to provider documentation and necessary further evidence is supported within the available contractual rights.
6. Annex IV - Providers, sub-processing and transfers
General authorisation and changes
General written authorisation under Clause 7.7(a), Option 2, applies on conclusion of the contract to the processing described in this Annex. It covers only services actually used and the data needed for them. Before adding or replacing a provider, we specifically notify the controller in text form at least 30 days in advance of the provider, activity, location and relevant safeguards. Silently updating this webpage does not replace notice. Objections are reviewed before use; where a justified data protection objection cannot be resolved, the affected processing is not continued without a sound solution.
Google Cloud and Firebase
Providers are the Google entities contractually responsible for the commissioned services, in particular Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, and, for relevant Firebase and infrastructure services, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The allocation follows the existing contract and Google contracting-entity directory. The specific entity engaged and its contractual basis must be documented in the provider record and made available to the controller on request.
Processing covers card data, images, pass files, authorisation assignments, delivery and workflow data, and necessary technical metadata for database, Cloud Storage, backend, authentication and background tasks. The product's backend and task region is configured around europe-west1. This is not a promise that every database, storage resource, authentication, support and metadata operation takes place exclusively in that region or the EEA.
The relevant sources are the applicable Firebase Data Processing and Security Terms, Google Cloud Data Processing Addendum, actually agreed resource locations, and the relevant Firebase subprocessors and Google Cloud subprocessors. Entities, activities and countries in those lists must be considered for the services used; we do not use every service named in the lists.
Vercel
Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA, operates the production web application and its delivery infrastructure. Depending on the route, card rendering, images or downloads and request data such as IP address, browser information and references are transmitted or processed by that infrastructure. This is separate from Vercel Flags for our own product experiments.
We use Vercel Pro with the agreed Vercel DPA. Processing may occur in the USA and other locations of the delivery network and subprocessors used for the selected services. Exclusively European processing is not agreed.
Transactional email through Resend
Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA, delivers requested card and other instruction-related email. Processing covers necessary recipient addresses, any names, message content, delivery links and delivery metadata. This covers only the delivery actually commissioned, rather than general authorisation to use employee data for newsletters or advertising.
Resend describes primary processing in the USA. The basis is the Resend DPA and transfer safeguards agreed for the account. Further providers are described in the Resend subprocessors list; Resend identifies Amazon Web Services in particular for hosting and sending. The full list does not imply that every listed function receives our card data.
International safeguards, other recipients and evidence
Transfers outside the EEA must actually meet the requirements of Chapter V GDPR. Depending on the recipient and processing, this may involve a valid adequacy decision within its scope or the applicable transfer clauses under Decision (EU) 2021/914 with the necessary assessment and supplementary measures. This agreement's Clauses under Decision 2021/915 do not replace that transfer basis. The processor checks and documents the appropriate basis; a provider list or generic DPF or SCC promise alone is insufficient.
Sub-processors are bound by the obligations required by Clause 7.7. Further sub-processing chains, changes, evidence and requests are handled under that Clause. On request, the controller is provided with relevant provider identities, locations and safeguards, and contract copies available under Clause 7.7(c). Provider webpages are information sources and do not automatically amend the agreed contractual version.
Apple Wallet, independent Google Wallet account services, Google Maps/Places for requested location searches, link destinations chosen by the controller and recipients' email providers are other recipients under the role distinction in Annex II. This list does not declare them blanket instructed sub-processors. Our own analytics, advertising, payment and AI services are not authorised as processing of employee card content. Where a separate instruction requires further providers, they must be included under the above rules before use.