Subprocessors and Other Providers
Effective and last updated: July 31, 2026
1. How to read this list
In this list, "Provider" means Pentatope Technologies Kft., the company that provides Avum. A subprocessor is a service provider the Provider engages to process Customer Personal Data for the customer-directed processor activities covered by Avum's Data Processing Addendum. A service provider may also process separate data for which the Provider is the controller. Its role depends on the processing activity, not only on the service provider's name.
Locations below are principal or relevant locations, not every secured support location. A provider's current contract, DPA, configuration, and disclosures give the more specific details.
2. Authorized subprocessors
| Provider | Service and purpose | Customer Personal Data | Processing location and safeguard |
|---|---|---|---|
| Microsoft Ireland Operations Limited and Microsoft affiliates supporting Azure | Azure cloud infrastructure, hosting, monitoring, security, and recovery services. | Service data, including OAuth credentials and event details processed transiently. | EEA, including West Europe. Disclosed support and subprocessors may use other locations. Transfers use adequacy or contractual safeguards. See the Microsoft Products and Services DPA. |
| Cloudflare, Inc. | Website and application delivery, Workers hosting, DNS, and security. | Request, security, and other data processed by the Cloudflare-hosted runtime. | Global network, including the EEA and United States. Restricted transfers use the safeguards in the Cloudflare DPA. |
| Sendinblue SAS, trading as Brevo | Transactional email delivery, including sign-in links and service communications. | Recipient, message, and delivery data. No connected-calendar event details. | Primarily the EEA, with disclosed subprocessors elsewhere. Transfers require a lawful safeguard. See Brevo's official DPA information page. |
3. Processors used for the Provider's controller activities
The providers above may also process data for which the Provider is the controller. The Provider also uses:
| Provider | Purpose and data | Role and information |
|---|---|---|
| Google Cloud EMEA Limited | Google Workspace email hosting and document storage, and reCAPTCHA abuse prevention for passwordless authentication. | Processor under the Google Cloud DPA. Data may include hosted email, attachments, documents, account and usage metadata, and reCAPTCHA interaction, network, and risk data. See the reCAPTCHA FAQ. |
4. Customer-selected providers and independent controllers
The following parties are not the Provider's subprocessors for customer-directed calendar processing:
- Google calendar and account services.A user or Customer selects and authorizes the account and directs Avum's exchange with Google. Google's role is governed by the account owner's agreement and the Google Privacy Policy.
- Microsoft calendar and account services.A user or Customer selects and authorizes the account and directs Avum's exchange with Microsoft. Microsoft's role is governed by the account owner's agreement and its Privacy Statement.
- The applicable Paddle entity. Paddle acts as Merchant of Record and processes purchase, billing, fraud, and transaction data under its Privacy Notice. It does not process calendar content.
5. Changes and objections
The Provider will update this page when it appoints or replaces a subprocessor that processes Customer Personal Data. Notice and objection rights for business customers are governed by the Data Processing Addendum. Questions or reasonable data-protection objections may be sent to contact@avum.io.