Legal
Subprocessors and key recipients
This page lists the subprocessors and key recipients we use to deliver our services. For each entry we state the provider, service, processing purpose, high-level data categories, location (countries), role, and — where a third-country transfer is involved — the transfer mechanism. Roles distinguish true subprocessors (where we act as processor) from independent controllers and technical recipients (for example an OAuth identity provider or a certificate authority).
Where we process personal data on behalf of a customer who determines the purposes and means of processing, HDS acts as processor under Art. 4(8) GDPR. Before such processor processing begins, the parties enter into a data processing agreement or other legally binding arrangement satisfying Art. 28 GDPR via the customer portal, DocuSeal, or the applicable contract. Intended additions or replacements of subprocessors are governed by that arrangement — general authorisation with an opportunity to object. HDS notifies the Customer of intended additions or replacements of subprocessors at least 14 days before the change takes effect, unless a shorter period is required for urgent security, legal, or operational need. Notice is sent from legal@horvath-digital.solutions to the Customer. The Customer may object by reply to legal@horvath-digital.solutions, as provided in the Art. 28 arrangement. The EU–US Data Privacy Framework (the DPF) is cited only where this list expressly names it for a recipient — and only where the relevant recipient entity and the relevant processing are covered by that certification.
This list is provided in German and English. In case of conflict or ambiguity, the German text prevails. The English text is a convenience translation.
This page supplements our privacy policy.
The standard Art. 28 text is on our data processing agreement. Publishing that page does not by itself conclude an Art. 28 agreement.
This inventory is the public list of subprocessors and key recipients referred to in that Art. 28 arrangement. Provider-specific transfer wording is on the cards below.
Subprocessors and key recipients
Hetzner Online GmbH
- Service
- Server hosting / compute
- Processing purpose
- Host and operate websites, mail, managed hosting, DocuSeal (self-hosted by HDS), Verify, Sentinel, the customer portal, and HDS Broadcast™ (newsletter) on infrastructure we configure and operate
- Data categories
- Hosted customer and account content; technical access and operations logs; communication and billing-related data as needed for the contracted service
- Location
- Germany (EEA)
- Role
- Processor to HDS where HDS acts as controller; subprocessor where HDS acts as processor for customer data
The Constant Company, LLC (Vultr)
- Service
- Anycast / edge for authoritative DNS
- Processing purpose
- Authoritative DNS zone serving for HDS DNS™ at anycast PoPs — not query-log analytics
- Data categories
- Authoritative DNS zone file content for serving at anycast PoPs (including non-EEA). Primary zone data remains on Hetzner. Zone sync/transfer does not include client (querier) IP addresses; queried names are not transferred back to HDS
- Location
- US entity; DNS/anycast PoPs — EEA PoPs plus United Kingdom, Switzerland, United States, Singapore, and Australia
- Role
- Processor to HDS where HDS acts as controller for zone delivery; subprocessor where HDS acts as processor for customer zone data
- Transfer mechanism
- HDS uses Constant Company (Vultr) for authoritative DNS zone serving at anycast PoPs under the Constant Company DPA. Per that DPA: processor of Customer Data; controller of Account Data. Where transfers from the EEA are not covered by an adequacy decision: EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) — Module Two where an EEA controller transfers to Vultr acting as processor; Module Three where HDS acting as processor transfers to Vultr acting as subprocessor. UK transfer mechanism: UK adequacy where applicable; otherwise UK IDTA or EU SCCs together with the UK Addendum, as applicable. Switzerland: EU SCCs with Swiss adaptations (FDPIC / Swiss courts / Swiss law as set out in that DPA). Adequacy decisions apply where the destination is adequate (e.g. EEA→United Kingdom / EEA→Switzerland). PoPs may include non-adequate destinations (United States, Singapore, Australia). This entry does not rely on the EU–US Data Privacy Framework. Limited to authoritative DNS / zone serving — not query-log analytics.
iFog GmbH
- Service
- Anycast / edge for authoritative DNS
- Processing purpose
- Authoritative DNS zone serving for HDS DNS™ at anycast PoPs — not query-log analytics
- Data categories
- Authoritative DNS zone file content for serving at anycast PoPs (including non-EEA). Primary zone data remains on Hetzner. Zone sync/transfer does not include client (querier) IP addresses; queried names are not transferred back to HDS
- Location
- Switzerland (entity); DNS/anycast PoPs — EEA PoPs plus United Kingdom, Switzerland, United States, Singapore, and Australia
- Role
- Processor to HDS where HDS acts as controller for zone delivery; subprocessor where HDS acts as processor for customer zone data
- Transfer mechanism
- iFog GmbH is established in Switzerland. EEA→Switzerland and EEA→United Kingdom: EU adequacy decisions apply where relevant. Where DNS/anycast zone serving involves processing in countries without an adequacy decision (including the United States, Singapore, and Australia): EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) — Module Two where an EEA controller transfers to iFog acting as processor; Module Three where HDS acting as processor transfers to iFog acting as subprocessor. Swiss adaptations where Swiss law so requires. UK transfer mechanism: UK adequacy where applicable; otherwise UK IDTA or EU SCCs together with the UK Addendum, as applicable. This list does not assert EU–US Data Privacy Framework certification for iFog. Limited to authoritative DNS / zone serving — not query-log analytics.
GitHub, Inc.
- Service
- OAuth identity provider for portal sign-in
- Processing purpose
- Authenticate users for the customer portal via OAuth
- Data categories
- OAuth identity attributes needed to create or link a portal account (as provided by the IdP, e.g. account identifiers and email)
- Location
- United States / global (IdP)
- Role
- Technical recipient / independent identity provider for OAuth — not an HDS hosting subprocessor
- Transfer mechanism
- Independent identity provider. HDS receives identity attributes in the EEA for customer-portal sign-in. The IdP processes its own sign-in, which may include processing in the United States. EU–US Data Privacy Framework only where the relevant recipient entity and the relevant processing are covered by that certification; otherwise Art. 46 GDPR safeguards apply if and to the extent they apply to that independent processing. This list does not describe HDS as exporter of customer content to a United States processor.
Google LLC
- Service
- OAuth identity provider for portal sign-in
- Processing purpose
- Authenticate users for the customer portal via OAuth
- Data categories
- OAuth identity attributes needed to create or link a portal account (as provided by the IdP, e.g. account identifiers and email)
- Location
- United States / global (IdP)
- Role
- Technical recipient / independent identity provider for OAuth — not an HDS hosting subprocessor
- Transfer mechanism
- Independent identity provider. HDS receives identity attributes in the EEA for customer-portal sign-in. The IdP processes its own sign-in, which may include processing in the United States. EU–US Data Privacy Framework only where the relevant recipient entity and the relevant processing are covered by that certification; otherwise Art. 46 GDPR safeguards apply if and to the extent they apply to that independent processing. This list does not describe HDS as exporter of customer content to a United States processor.
Mollie B.V.
- Service
- Payment services (licensed PSP)
- Processing purpose
- Process payments as an independent payment service provider; HDS receives payment status and references only
- Data categories
- Payment-instrument and transaction data processed by Mollie as independent controller (HDS does not store card PAN or Mollie payment IBANs; bank-transfer IBANs via Lexware — see privacy policy)
- Location
- Netherlands (EEA)
- Role
- Independent controller / PSP — not an HDS subprocessor
Haufe Service Center GmbH (Lexware Office)
- Service
- Lexware Office — HDS administration, invoicing and accounting
- Processing purpose
- HDS’s own administration, invoicing and accounting only — not product-hosting infrastructure for customer workloads
- Data categories
- Customer administration and billing/accounting records; where customers pay by bank transfer — payer name, IBAN, amounts, dates, remittance text and similar account-visible details
- Location
- Germany — Munzinger Straße 9, 79111 Freiburg; core Lexware Office hosting in Germany
- Role
- Art. 28 processor to HDS for HDS’s own admin/billing/accounting — not an infrastructure subprocessor for customer product hosting
- Transfer mechanism
- Core Lexware Office hosting is in Germany. Lexware’s approved further processors for supplemental features may process outside the EEA under adequacy and/or SCCs (Art. 45/46) as set out in Lexware’s privacy notice (https://datenschutz.lexware.de/lexware-office) and Art. 28 DPA (https://avv.lexware.de/lexware-office).
Let’s Encrypt / ISRG
- Service
- TLS certificate issuance (ACME)
- Processing purpose
- Issue and renew TLS certificates for HDS systems and for customer hosting and mail domains on systems we operate
- Data categories
- Domain names and ACME technical validation data (may constitute personal data in context). No mailbox content and no hosted application content
- Location
- United States (CA operations)
- Role
- Technical certificate authority / ACME recipient for TLS on HDS systems and on customer hosting and mail domains that HDS operates — not a subprocessor of mailbox or hosted application content; for customer domains, ACME runs under the customer’s documented instructions / contracted hosting-mail setup (HDS as processor)
- Transfer mechanism
- Domain names and ACME technical validation data only — no mailbox content and no hosted application content. Where customer domains are involved, disclosure follows the customer’s documented instructions under the contracted hosting/mail setup (HDS as processor). This list does not assert SCCs or EU–US Data Privacy Framework certification for Let’s Encrypt. ISRG privacy notice: https://letsencrypt.org/privacy/.