This page lists the third-party service providers that MB Firmavis (“Firmavis”) engages to process personal data in connection with the service. Most act as our processors (“sub-processors”) on our documented instructions under Article 28 GDPR agreements; some additionally act as independent controllers for limited purposes of their own — for example payment regulation and fraud prevention, or a vendor’s own customer-account records — and these mixed roles are noted in the table. We publish this page for transparency in accordance with Articles 13(1)(e) and 14(1)(e) GDPR. It should be read together with our Privacy Policy.
1. Current sub-processors
| Sub-processor | Service | Entity location | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Hetzner Online GmbH | Application hosting and primary database | Germany | Helsinki, Finland | Intra-EEA — no transfer mechanism required |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Payment processing, tax calculation, billing and invoicing (Stripe also processes payment data as an independent controller for its own regulatory and fraud-prevention purposes) | Ireland (EEA) / United States | Ireland and United States | EU-US Data Privacy Framework; 2021 SCCs as fallback |
| Clerk, Inc. | User authentication and session management (Clerk also acts as an independent controller for limited account information of its own, as described in its DPA) | United States | United States | EU-US Data Privacy Framework; 2021 SCCs as fallback |
| Cloudflare, Inc. | Content delivery network, DDoS protection and web application firewall | United States | Global edge network, including EU points of presence | EU-US Data Privacy Framework; 2021 SCCs as fallback |
| Google Ireland Limited / Google LLC | Website analytics (Google Analytics 4) | Ireland (EEA) / United States | Ireland and United States | EU-US Data Privacy Framework; 2021 SCCs as fallback |
| Plus Five Five, Inc. (Resend) | Transactional email delivery (contact replies, export notices, data-removal confirmations and internal notices to our own support inbox, such as payment alerts — sent without open- or click-tracking) | United States | United States (primary) | EU-US Data Privacy Framework; 2021 SCCs as fallback |
| Fastmail Pty Ltd | Business mailboxes for our support and privacy addresses — correspondence with customers and the data-protection requests people send us | Australia | Amsterdam, Netherlands (primary copy); United States (replica, backups and logs) | 2021 SCCs under its data-processing agreement |
| GBD Software as a Service Private Limited Company (MillionVerifier) | Business email-address deliverability verification | Hungary | Primarily Hungary (EEA); its policy permits processing outside the EEA | Intra-EEA processing requires no mechanism; 2021 SCCs under its DPA for any non-EEA processing |
| OpenRouter, Inc. | Large-language-model inference in our data pipeline: (a) the local part of an email address, without its domain, together with a country code, to classify whether the address belongs to a person or to a business role, so that personal addresses can be excluded from the database; (b) company names, to help locate a company’s published contact details. No customer or account data is sent. | United States | Requests are routed through OpenRouter’s EU regional endpoint with zero data retention enforced at the router; the model providers are those that OpenRouter’s EU and zero-retention routing selects | 2021 SCCs |
| Serper Technologies, Inc. (Serper.dev) | Web-search results used to locate a company’s own published contact page. Queries contain a company name and location, not a person’s name. Engagement commences if and when this pipeline step is activated; it is not in use today. | United States | United States | 2021 SCCs |
2. Changes and prior notice
We update this page before any new sub-processor that will process personal data takes effect — normally at least 30 days in advance — so that you have the opportunity to raise concerns. If we cannot resolve a reasonable objection, your remedy as a customer is to cancel your Subscription before the change takes effect; §13 of the Terms of Service applies.
3. How we engage sub-processors
We engage each sub-processor under a written data-processing agreement (Article 28(3) GDPR), incorporating, where applicable, the 2021 Standard Contractual Clauses for international transfers and the controller-processor terms required by Article 28(3) GDPR.
4. Transfers outside the EEA
Where a sub-processor processes personal data outside the European Economic Area, we rely on the EU-US Data Privacy Framework for DPF-certified recipients in the United States, with the 2021 Standard Contractual Clauses as a fallback, and on the 2021 Standard Contractual Clauses for recipients that are not DPF-certified or are outside the United States. Data Privacy Framework certification status for U.S. sub-processors is verified against the official Data Privacy Framework list at dataprivacyframework.gov. The validity of the Framework is the subject of a pending appeal before the Court of Justice of the European Union; we monitor those proceedings and will update our transfer mechanisms if the legal position changes. Further detail on international transfers is in our Privacy Policy.
5. Contact
For any question about our sub-processors, contact us at [email protected].
MB Firmavis
Lithuanian company code: 307941710
Registered in the Register of Legal Entities of the Republic of Lithuania (administrator: State Enterprise Centre of Registers)
Registered office: Laisvės al. 85E-5, LT-44297 Kaunas, Lithuania
VAT number: LT100020426112
Privacy matters: [email protected]
General contact: [email protected]
This document is published in English. Translations into other supported languages may be published at a corresponding translated URL under /legal. In the event of any discrepancy between the English version and any translation, the English version prevails to the extent permitted by applicable law.