OFFERANDUM LIST OF SUBPROCESSORS
Annex 1 to the Data Processing Agreement · Effective September 24, 2026 · Version 1.0
This document names the further processors Offerandum uses when handling data entrusted by companies. It is part of the Data Processing Agreement.
SUBPROCESSORS
| Provider | Services | Categories of data |
|---|---|---|
| Cloudflare, Inc., United States | Application infrastructure and request handling, databases, file storage, cache, task queues, document generation, sending e-mail, protection and diagnostics of the service. | Contact details and parameters of enquiries, form data, content and metadata of PDF quotes, information about the handling of enquiries, recipients and content of messages, and the technical data needed to provide the service. |
| Google LLC, United States (Gemini API) | Language model of the AI assistant in forms where the Customer has switched it on: reading the person's messages, choosing values for the form's fields and answering questions about the form. API service; the content is not used to train models. | The content of messages typed in the conversation with the assistant, including any details the person gives there, the earlier messages of that conversation and a description of the form's fields with their current values. No price list, form code, PDF documents or panel data. |
| OpenAI, L.L.C., United States (API) | Language model of the AI assistant in forms where the Customer has switched it on, in the same scope as Google LLC; each form uses one of these providers. API service under business terms; the content is not used to train models. | The content of messages typed in the conversation with the assistant, including any details the person gives there, the earlier messages of that conversation and a description of the form's fields with their current values. No price list, form code, PDF documents or panel data. |
| Anthropic Ireland, Limited, Ireland (Claude API) | Language model of the AI assistant in forms where the Customer has switched it on, in the same scope as Google LLC and OpenAI, L.L.C.; each form uses one of these providers. API service under commercial terms; the content is not used to train models. | The content of messages typed in the conversation with the assistant, including any details the person gives there, the earlier messages of that conversation and a description of the form's fields with their current values. No price list, form code, PDF documents or panel data. |
| Stripe, Inc., United States | Card payments for the Offerandum subscription and fees. Stripe processes the Customer's payment data as a payment service provider; Offerandum never receives the full card number. | Billing name, e-mail address, billing address, card details and payment amounts of the Customer. No enquiries, form data or PDF quotes: Stripe processes the Customer's own account data, for which Offerandum is the controller, and is listed here so that the full chain of providers is in one place. |
Each Cloudflare service processes data to the extent needed for its function. For example, the D1 database holds the list of enquiries and their handling, and R2 holds the files of enquiries and documents. Queues carry tasks such as sending messages or deleting files.
The language model provider receives data only at the moment of the conversation with the assistant and does not store it for us; when the person sends the enquiry, the record of the conversation goes only to Cloudflare R2.
DATA LOCATION AND TRANSFERS
Files stored in Cloudflare R2 are held under European Union jurisdiction. This restriction applies to the R2 storage service and does not mean that every operation of the other Cloudflare services takes place only within the EU.
Cloudflare operates infrastructure and support in many countries. Processing by its other services, by technical support or by its own further processors may involve transferring data outside the European Economic Area, including to the United States.
Transfers from the EEA take place under Chapter V of the GDPR. The mechanisms used are an adequacy decision of the European Commission where it covers the recipient and the transfer, or the EU Standard Contractual Clauses with a transfer assessment and additional safeguards where needed.
Google LLC and OpenAI, L.L.C. process assistant requests in the United States. Google LLC participates in the EU-U.S. Data Privacy Framework, so transfers to Google rest on the European Commission's adequacy decision of July 10, 2023; independently of that, both transfers rest on the Standard Contractual Clauses included in the providers' data processing terms. Anthropic Ireland, Limited is established in the European Union but may process assistant requests outside the European Economic Area, including in the United States; such an onward transfer rests on the Standard Contractual Clauses in its data processing terms. Terms: Gemini API terms and Google Cloud Data Processing Addendum; OpenAI business terms and OpenAI Data Processing Addendum; Anthropic commercial terms, Anthropic Data Processing Addendum and the Anthropic list of subprocessors.
Stripe processes payment data in the United States and describes its own transfer mechanisms in its privacy policy.
The processing terms and the further chain of providers are described in the Cloudflare DPA and the Cloudflare list of subprocessors. Information about the mechanism and safeguards of a specific transfer, and how to get a copy of them, is available on request to contact@offerandum.com.
RULES FOR USING SUBPROCESSORS
- The Customer authorizes Offerandum to use the subprocessors named in the accepted version of this annex, in accordance with the DPA.
- Offerandum imposes appropriate data protection obligations on its subprocessors and remains liable to the Customer for the performance of the obligations entrusted to them.
- We notify the Customer's named contact of the addition or replacement of a subprocessor at least 14 days before the new provider gets access to the data. The notice names the provider, the scope of its task, the place of processing and the rules of any transfer.
- The Customer may object on grounds related to data protection before the new subprocessing starts. How an objection is handled, and what happens if no solution is found, is set out in the DPA.
- Updating this page does not replace the required notice. An urgent change needs separate authorization, or the feature is suspended, if the agreed notice period cannot be kept.
OTHER PROVIDERS AND RECIPIENTS
This list concerns the processing of enquiries and other data on behalf of companies using Offerandum. Providers of the services Offerandum uses for its own billing, contacts and analytics are described in the Privacy Policy, according to their role.
Cal.com is used to book demonstrations and calls with Offerandum; it receives the details of the person booking and not the Customer's enquiries.
Google Analytics and PostHog analyze Offerandum's pages (after cookie consent), and PostHog also how people from companies use the panel, as described in the Privacy Policy. They do not cover companies' forms, the hosted pages with those forms, or the content of contact forms, enquiries and leads.
Google also provides optional sign-in to Offerandum accounts. For this feature we process the identity data of the account user as described in the Privacy Policy. No entrusted enquiries, quotes or documents of companies are sent to Google for sign-in. This feature is not a subprocessing of enquiry data under the DPA.
For form features that use external services, such as address suggestions, maps or fonts, the scope of data sent and the processing rules are described in the Privacy Policy and in the information about the given feature. A provider does not become a subprocessor merely because the browser loads a resource from it. Where a feature requires further processing on the Customer's behalf, we follow the DPA procedure before any data is passed on.
The company receiving an enquiry and the recipient of a quote are determined by the form's configuration and by the person sending the enquiry. Their e-mail providers do not become subprocessors engaged by Offerandum merely by receiving a message.
CONTACT AND RELATED DOCUMENTS
For questions about subprocessors, write to contact@offerandum.com. The responsibilities of the parties are set out in the DPA, and how data is protected is described in Annex 2, Security measures.