List of Sub-processors
Last updated: 1 June 2026
In compliance with Art. 28 GDPR and Annex I of the Findalo Service Agreement, we publish below the list of providers acting as Sub-processors in the delivery of the Findalo Service.
Sub-processors are entities we engage to deliver specific parts of the Service (infrastructure, payments, communications, etc.). All of them are bound by contract and required to uphold the same security and confidentiality standards that Findalo commits to towards the Customer.
Current list
| Function | Data type | Location | Legal basis |
|---|---|---|---|
| Cloud infrastructure and CDN | Customer catalogue, usage metrics, search logs, account data | EU / USA | Adequacy decision (EU-US DPF) and Standard Contractual Clauses |
| Backup hosting | Service static assets, fallbacks | EU | GDPR — processing within the EEA |
| Payment gateway | Billing data; card data is not stored by Findalo | EU / USA | Adequacy decision (EU-US DPF) and Standard Contractual Clauses |
| Transactional email delivery | Customer email address and message content | EU / USA | Standard Contractual Clauses |
| AI models for image search and semantic search (optional) | Customer catalogue images and texts when the Customer enables the feature | EU / USA | Standard Contractual Clauses |
| Public website visitor analytics (Google Analytics 4, consent-gated only) | Aggregated and anonymous navigation metrics: page views, traffic source, events. No advertising tracking or remarketing audiences | EU / USA | Explicit consent (banner) + EU-US DPF + Standard Contractual Clauses |
| Public website session-replay and heatmaps (Mouseflow, consent-gated only) | Mouse movements, clicks, scroll, non-sensitive inputs. Passwords, emails and payment forms are masked automatically | EU (Denmark) | Explicit consent (banner) — processing within the EEA |
Specific providers may vary within each category. This list identifies the functions sub-contracted, in accordance with Article 28.2 GDPR. The specific identity of the provider operating each function will be disclosed to Customers who formally request it in writing at the email address below, in the context of their due-diligence obligations as Data Controllers.
Change notification
We will notify the Customer, with a minimum advance notice of 15 calendar days, of any addition, replacement or removal of a Sub-processor. Notification will be sent by email to the contact address registered on their account and/or via a notice in the Service panel.
The Customer may object to a new Sub-processor on legitimate data-protection grounds. In that event, the Parties shall negotiate in good faith to find a solution; if none is reached, the Customer may terminate the agreement without penalty with 30 days' notice.
Contact
For any query about Sub-processors or the processing of personal data: legal@findalo.io.