Subprocessors and Data Flow

Subprocessors and Data Flow

Attached you find a list of all subprocessors of the products and services provided by the Interactive Paper GmbH.

Company Name
Company Location
Importance
Service
Data Location
Data Categories
DigitalOcean EU B.V. - Zweigniederlassung Deutschland
Am Sandtorkai 68, 20457 Hamburg, Germany
Mandatory
Hosting and infrastructure services for storing and processing data.
Germany (DigitalOcean Data Center)
Personal Data as determined by the Controller.
Grunewald GmbH
Lindenbergstraße 4434123 Kassel, Germany
Optional, only if address data is exchanged
Production partner / processing of address data for postal dispatch
Germany
Address data of end-users
MRD GmbH
Siegener Straße 41157258 Freudenberg, Germany
Optional, only if address data is exchanged
Production partner / processing of address data for postal dispatch
Germany
Address data of end-users
Artisan Colour
8970 E Bahia Dr, Scottsdale, AZ 85260, United States
Optional, only if address data is exchanged and mailed out in the United States
Production partner / processing of address data for postal dispatch
United States
Address data of end-users Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914.
Stripe, Inc.
354 Oyster Point Blvd, South San Francisco, CA 94080, United States
Mandatory, only if client uses paid subscription
Payment processing and subscription billing. Used when a client purchases or renews a paid subscription plan on the  letsinteract.com  platform. Processes billing name, email, and payment card data.
Ireland (EU) — Stripe Payments Europe, Ltd., Dublin. Data stored within EEA.
Billing contact name, email address, payment card data (tokenised), billing address, subscription details. Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914.
Google LLC (Google Analytics 4)
1600 Amphitheatre Parkway, Mountain View, CA 94043, United States
Only if client enables analytics (location tracking requires explicit client configuration)
Web analytics and usage tracking for the Creator platform. Collects anonymised usage data (page views, session duration, feature interactions) to understand platform usage patterns. Active whenever a logged-in user interacts with the Creator application.
European Union (Google EU Data Centre)
Pseudonymised user identifiers, IP addresses (anonymised), browser/device data, page URLs, session and interaction events. Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914.
Google LLC (Google OAuth / SSO)
1600 Amphitheatre Parkway, Mountain View, CA 94043, United States
Optional, only if user selects Google login
Single Sign-On (SSO) authentication via Google OAuth 2.0. Used when a platform user chooses to log in to the Creator application using their Google account. Transfers name, email address and Google account identifier upon login.
European Union (Google EU Data Centre)
Name, email address, Google account identifier. Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914.
LinkedIn Corporation
1000 West Maude Avenue, Sunnyvale, CA 94085, United States
Optional, only if user selects LinkedIn login
Single Sign-On (SSO) authentication via LinkedIn OAuth 2.0. Used when a platform user chooses to log in to the Creator application using their LinkedIn account. Transfers name, email address and LinkedIn profile ID upon login.
United States
Name, email address, LinkedIn profile identifier. Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914.
Microsoft Corporation (Azure AD / Entra ID)
One Microsoft Way, Redmond, WA 98052, United States
Optional, only if user selects Microsoft/Azure AD login
Enterprise Single Sign-On via Microsoft Azure Active Directory (Entra ID). Used when a corporate user logs in to the Creator application using their company Microsoft account. Primarily used by enterprise clients with Microsoft 365 tenants.
United States (EU data residency available via Microsoft EU Data Boundary)
Name, email address, Microsoft/Azure AD account identifier, tenant ID. Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914.
WeClapp GmbH
Lauteschlägerstraße 23, 64289 Darmstadt, Germany
Mandatory, only if client has a paid subscription or purchase order
ERP system used for invoicing, customer account management, and accounting. Client contact and billing data is transferred to WeClapp when a subscription is created, renewed, or a purchase order is issued. Data remains within the EU (Germany).
Germany (EU)
Client company name, billing contact name, email address, postal address, VAT number, subscription/order details. No transfer outside the EEA — no SCCs required.
Google LLC (Gmail API — Transactional Email)
1600 Amphitheatre Parkway, Mountain View, CA 94043, United States
Mandatory
Transactional email delivery via Gmail API service account. Used to send platform-triggered emails such as campaign invitations, account registration confirmations, and access notifications to end-users and platform users.
European Union (Google EU Data Centre)
Recipient email addresses, name (where included in email), email subject and body content of platform notifications. Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914.
HubSpot, Inc.
25 First Street, Cambridge, MA 02141, United States (EU data hosted in Germany via HubSpot EU Data Centre)
Mandatory (for clients whose data is stored in CRM)
CRM and customer account management. Stores client contact details, company information, deal history, and communication records for Interactive Paper's sales and account management operations.
European Union (Germany — HubSpot EU Data Centre)
Client company name, billing contact name, email address, phone number, deal information, communication history. No transfer outside the EEA — no SCCs required.
Cloudflare, Inc.
101 Townsend Street, San Francisco, CA 94107, United States
Mandatory
Reverse proxy, CDN, Web Application Firewall (WAF) and DDoS protection. All web traffic to the  letsinteract.com  platform and campaign landing pages is routed through Cloudflare's network before reaching the hosting infrastructure.
Global edge network; requests are processed at the Cloudflare data centre closest to the visitor (EU data centres for visitors in the EU). Application data at rest remains with DigitalOcean (Germany).
IP addresses, HTTP request metadata (URL, headers, user agent), security and traffic logs. Transfer basis: EU-US Data Privacy Framework and EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914.
ClickHouse, Inc. (ClickHouse Cloud)
c/o Goodwin Procter LLP, 601 Marshall St, Redwood City, CA 94063, United States
Mandatory
Analytics database (ClickHouse Cloud) for storing and evaluating campaign interaction and usage data that powers the campaign reports on the  letsinteract.com  platform. Runs on Amazon Web Services infrastructure operated on behalf of ClickHouse.
Germany (EU) — AWS region eu-central-1, Frankfurt
Pseudonymised end-user identifiers (incl. personalisation ID in personalised campaigns), interaction and event data, device/browser data (OS, browser, device brand and model, browser language), approximate location (country, region, city), consent flags. Transfer basis: EU-US Data Privacy Framework and EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914.

PDF document 3MB
It appears you do not have a PDF plugin for this browser.


PDF document 4MB
It appears you do not have a PDF plugin for this browser.