Subprocessors and Other Providers
Effective: July 31, 2026
Hosting-provider information updated: October 24, 2026
1. How to read this list
In this list, "Provider" means Pentatope Technologies Kft., the company that provides Avum. A subprocessor is a service provider the Provider engages to process Customer Personal Data for the customer-directed processor activities covered by Avum's Data Processing Addendum. A service provider may also process separate data for which the Provider is the controller. Its role depends on the processing activity, not only on the service provider's name.
Locations below are principal or relevant locations, not every secured support location. A provider's current contract, DPA, configuration, and disclosures give the more specific details.
2. Authorized subprocessors
| Provider | Service and purpose | Customer Personal Data | Processing location and safeguard |
|---|---|---|---|
| dataforest GmbH (AVORO) [email protected] | VPS hosting for the production application, database, and object storage. | Service data processed or stored on the hosted production infrastructure. | Provider address: Taunusstraße 52, 65830 Kriftel, Germany. See the AVORO official imprint. |
| Cloudflare, Inc. | Reverse proxy, CDN, DNS, and security for production website and API traffic. | Request and security data processed while proxying website and API traffic. | Cloudflare operates a global network. See the Cloudflare DPA for its published data-processing terms. |
| Sendinblue SAS, trading as Brevo | Transactional email delivery, including sign-in links and service communications. | Recipient, message, and delivery data. No connected-calendar event details. | Primarily the EEA, with disclosed subprocessors elsewhere. Transfers require a lawful safeguard. See Brevo's official DPA information page. |
3. Processors used for the Provider's controller activities
The providers above may also process data for which the Provider is the controller. The Provider also uses:
| Provider | Purpose and data | Role and information |
|---|---|---|
| Google Cloud EMEA Limited | Google Workspace email hosting and document storage, and reCAPTCHA abuse prevention for passwordless authentication. | Processor under the Google Cloud DPA. Data may include hosted email, attachments, documents, account and usage metadata, and reCAPTCHA interaction, network, and risk data. See the reCAPTCHA FAQ. |
4. Customer-selected providers and independent controllers
The following parties are not the Provider's subprocessors for customer-directed calendar processing:
- Google calendar and account services. A user or Customer selects and authorizes the account and directs Avum's exchange with Google. Google's role is governed by the account owner's agreement and the Google Privacy Policy.
- Microsoft calendar and account services. A user or Customer selects and authorizes the account and directs Avum's exchange with Microsoft. Microsoft's role is governed by the account owner's agreement and its Privacy Statement.
- The applicable Paddle entity. Paddle acts as Merchant of Record and processes purchase, billing, fraud, and transaction data under its Privacy Notice. It does not process calendar content.
5. Changes and objections
The Provider will update this page when it appoints or replaces a subprocessor that processes Customer Personal Data. Notice and objection rights for business customers are governed by the Data Processing Addendum. Questions or reasonable data-protection objections may be sent to [email protected].