Sub-processor list — EduRegie
Annex to the data processing agreement. Updated whenever a sub-processor changes — schools are informed of this in advance in accordance with article 6.2 of the data processing agreement.
| Sub-processor | Function | Processing location | Nature of the data |
|---|---|---|---|
| Supabase (Supabase Inc.) | Database and authentication hosting (PostgreSQL, user accounts) | EU-West (Ireland) | All operational absence, timetable and user data |
| Vercel Inc. | Hosting of the web dashboard | EU region (to be confirmed in Vercel project settings) | Only relays traffic; no durable storage of personal data outside the Supabase database |
| Hostinger | Hosting of the n8n automation layer (VPS) | EU (exact country to be confirmed in the Hostinger panel; confirmed as EU region) | Data flowing through workflows during processing (not durably stored outside the database) |
| Hostinger | Email hosting for the sending account info@elhoucineautomation.nl (SMTP), for notifications (scheduler alerts, team leader updates, daily bulletin) | EU (exact country to be confirmed in the Hostinger panel; confirmed as EU region) | Name and email address of recipient, message content without medical data |
| Evolution API instance (self-hosted, same VPS as n8n) | WhatsApp reporting channel | Same region as the Hostinger VPS (EU) | Phone number and message text of the sender, operational content only |
| MessageBird (Bird B.V.) | Telephone absence reporting (voice/IVR) — planned, not yet in production | EU (Amsterdam) | Phone number of the reporter and (if transcribed) operational message content, no medical data |
| Google (Google Ireland Ltd.) | Google Sheets — pilot reporting/statistics dashboard | EU (Ireland, for EU tenant) | Only aggregated, non-identifiable statistics for as long as Sheets is used in pilot mode (see google-sheets/README.md) |
| Sentry (Functional Software, Inc.) | Error monitoring of the web dashboard | To be confirmed in Sentry project settings (EU hosting selectable) | Technical error data; no deliberately logged personal data, but error reports may occasionally contain context data |
Principles
- A sub-processor is only added if it itself offers a data processing agreement (or equivalent contractual safeguards, such as the EU Standard Contractual Clauses for processing outside the EEA).
- For production use with real absence data, Google Sheets is not used as a processor of personal data — see the recommendation in
google-sheets/README.mdto limit Sheets to anonymized statistics once a school goes live. - WhatsApp sending runs via a self-hosted Evolution API instance (no data via the Meta/WhatsApp Business Cloud API) — this should still be explicitly checked with a lawyer as to whether this is assessed as a sub-processor or as own infrastructure.
- The exact Hostinger data center country (for both the VPS and the email hosting) still needs to be confirmed in the Hostinger panel before this list is used as an annex to a customer contract — the EU region itself is confirmed.
- MessageBird was chosen as the telephony provider because of its EU establishment (Amsterdam), which simplifies the GDPR assessment compared to a US provider (which would require Standard Contractual Clauses). Only becomes an actual sub-processor once the telephony integration goes live.