Sended Sub-processor List

Version: 2.1-draft · Effective date: [not yet in effect]

1. About this list

This page lists the Sub-processors engaged by Elephants Production s.r.o., with its registered seat at Rybná 716/24, Staré Město, 110 00 Prague 1, Czech Republic, Company ID (IČO): 23397292, registered in the Commercial Register maintained by the Municipal Court in Prague, File No. C 426391 (the "Provider"), to process personal data on behalf of its business customers (each a "Customer" — the salon business holding the account) in connection with the Sended platform at sended.io (the "Service").

A Sub-processor is a third party engaged by the Provider that processes End Client Personal Data — on the Provider's behalf and under the Provider's instructions — in order to deliver the Service. End Client Personal Data has the meaning given in the Data Processing Agreement (Section 2.1 and Annex A): the personal data of the Customer's clients and prospective clients ("End Clients") that is processed through the Service on the Customer's behalf, and it includes the limited work data of the Customer's staff members synchronized from the Customer's CRM. Vendors that process data of the individuals using the Customer's account ("Authorized Users"), or account or billing data, in the Provider's own controller capacity are not Sub-processors and are described in the Privacy Policy. Capitalized terms not defined on this page have the meaning given in the Data Processing Agreement and in the Terms of Service.

This list is incorporated by reference into the Data Processing Agreement between the Provider and each Customer. By entering into the Data Processing Agreement, the Customer gives its general written authorization to the Provider's use of the Sub-processors listed below. The Customer's rights regarding Sub-processor changes (including the right to object) are set out in the Data Processing Agreement; in case of any conflict between this page and the Data Processing Agreement, the Data Processing Agreement prevails, except that this page prevails as to the identity of the Sub-processors, their locations and their transfer mechanisms (Data Processing Agreement, Annex C.1).

2. Sub-processors

3. Notes on specific Sub-processors

3.1 AWS regions and content delivery

The Service's infrastructure — application servers, relational database, queues, and object storage — runs in the AWS Frankfurt region (eu-central-1). Inbound email for the Provider's domains is routed through AWS in Ireland (eu-west-1).

Two classes of content are served through Amazon CloudFront's worldwide edge network. The first is the Service's own web applications: the Customer-facing application and the Provider's administration console are each delivered through their own CloudFront distribution, with no geographic restriction, so loading the application discloses the Authorized User's (or the Provider administrator's) IP address and client metadata to the edge location serving them.

The second is the images the Customer uploads for use in its messages and pages: brand assets (salon logos and background images) and per-message or per-campaign images. These objects are stored under a public, content-addressed path and cached at the edge for up to one year. Because such images are embedded in messages delivered to End Clients, when a recipient's mail or messaging client loads an image, CloudFront edge locations — including edge locations outside the EEA — receive that recipient's IP address and client metadata as part of serving the request.

In neither case does CloudFront receive message text or any other End Client data. The Customer must not upload images containing End Client personal data (such as client photographs); this is a condition of the Acceptable Use Policy, Section 8.

3.2 Meta (WhatsApp and Instagram)

Meta processes data only for Customers that have connected a WhatsApp Business Account (or, once the feature is enabled, an Instagram account) to the Service. WhatsApp messages initiated by the Customer outside WhatsApp's 24-hour customer-service window are sent using message templates that Meta reviews and hosts. Instagram Direct support is in development and applies only where and when the Provider enables it for a Customer.

Meta wears two hats here. It processes the message content described in the table above as a processor, under the WhatsApp Business Data Processing Terms accepted by the Customer. Separately, Meta processes data as an independent controller for its own purposes — platform integrity and abuse prevention, billing for conversation-based charges, and improvement of its services — under Meta's own terms and policies. That second activity is carried out on Meta's own responsibility and is not processing on the Provider's behalf; the Customer's relationship with Meta governs it. The same applies to the cookies Meta's sign-up SDK sets on the WhatsApp connection screen (see the Cookie Policy, Section 7.2).

For completeness: nothing in this list makes the Provider and the Customer joint controllers within the meaning of Article 26 GDPR. Each determines its own purposes and means for the processing allocated to it in the Data Processing Agreement.

3.3 AI model provider (OpenAI)

Data is sent to a model provider only in connection with the AI features of the Service — and the Service's AI features are disabled platform-wide at the date of this list, so no data flows to OpenAI until the Provider enables them. Google Gemini, which an earlier revision of this list named for campaign-name generation, has been removed from the Service entirely before launch and receives no Service data (see the change history in Section 5.1).

When the AI features are enabled, all of them are processed by OpenAI (United States):

• conversational assistant replies, classification of the intent of an incoming message, and voice transcription (Whisper) run only where the Customer has additionally switched the AI assistant on for its workspace;
• WhatsApp template drafting is a content-authoring aid that operates on template text the Customer is composing, not on End Client records.

Content sent to OpenAI is processed only to produce the requested output. It is not used to train or improve OpenAI's models, and is retained by OpenAI only for the limited abuse-monitoring period provided in its data processing terms [TO VERIFY: current OpenAI API retention terms — to be confirmed before the AI features are first enabled].

3.4 MongoDB Atlas region

The MongoDB Atlas cluster storing AI-assistant conversation history is pinned to the AWS Frankfurt region (eu-central-1); confirmed 2026-08-14. That history therefore remains in the EEA at rest. (While the AI features remain disabled platform-wide, no conversation history is written to it.)

3.5 Sentry — the capacity in which it acts

Sentry processes diagnostic data primarily in the Provider's own controller capacity: application error and availability monitoring is the Provider's security and audit-log processing, which Section 1.4 of the Data Processing Agreement places outside that agreement. To the extent an error report incidentally contains End Client Personal Data, Sentry acts as a Sub-processor for that data, and this list and the Data Processing Agreement apply to it. The Provider's error-reporting client is configured not to attach IP addresses, request headers or user identifiers, and email addresses and phone numbers are scrubbed from every payload before it leaves the Provider's systems. The Provider's Sentry organization is provisioned in Sentry's EU data-residency region (confirmed 2026-08-14): event data is stored in the EU, and the remaining United States transfer is limited to access by Sentry's support and operations personnel.

4. Connected services that are NOT Sub-processors

The following services receive personal data in connection with the Service, but not as Sub-processors engaged by the Provider. They are described here for transparency; further detail is in the Privacy Policy and the Data Processing Agreement.

4.1 Telegram

Telegram messages are sent from the Customer's own Telegram account, which the Customer connects to the Service by signing in with the Customer's own phone number (the Service does not use a Telegram bot). The Provider transmits messages through Telegram on the Customer's behalf and at the Customer's direction, using the Customer's own account session. Delivering a message requires matching the End Client's phone number against Telegram's user directory from the Customer's account, so End Client phone numbers and message content are disclosed to Telegram as the Customer's own communications provider, under Telegram's own terms of service. Telegram is not engaged by the Provider and has no contractual relationship with the Provider; it is therefore not a Sub-processor.

4.2 Google sign-in (OAuth)

Where an Authorized User chooses to sign in to the Service with a Google account, Google authenticates that individual directly under Google's own terms. The Provider receives from Google only the profile data needed to create and authenticate the account (name, email address, profile photo). In this role Google acts at the individual's choice, not as a Sub-processor of the Provider. Google does not appear in the Sub-processor table at all: sign-in, analytics and fonts are all outside the Sub-processor relationship, and the Google Gemini AI services named in an earlier revision have been removed from the Service.

4.3 Stripe (billing)

Stripe (Stripe Payments Europe Ltd, Ireland, with supporting processing in the United States by Stripe, Inc.) provides subscription billing and payment processing for the Customer's Sended subscription (Stripe Checkout and the Stripe Billing Portal). Stripe receives Customer billing data only: the Customer's billing email address, the billing name and postal address and any VAT or other tax identification number entered at checkout, subscription status and plan, and internal account identifiers. Payment card data is entered exclusively on Stripe-hosted pages and never reaches the Service. No End Client data is shared with Stripe. Because Stripe does not process End Client Personal Data, it is not a Sub-processor under the Data Processing Agreement — billing and subscription data is processed in the Provider's own controller capacity, outside the scope of the Data Processing Agreement (see its Section 1.4), as described in the Privacy Policy. Stripe processes this data under the Stripe Data Processing Agreement, including Stripe's Data Transfers Addendum (SCCs); Stripe, Inc. is DPF-certified.

In addition, Stripe processes personal data as an independent controller for its own purposes — fraud prevention and monitoring, financial and anti-money-laundering compliance, and improvement of Stripe's services — under Stripe's own privacy policy. Those activities are carried out on Stripe's own responsibility and are not processing on the Provider's behalf.

4.4 Altegio (the Customer's own CRM)

The Service connects to the Customer's own Altegio (alteg.io) account and, at the Customer's direction, synchronizes End Client, staff, service and appointment data from it and writes bookings and client updates back to it. Altegio — operated by Altegio Europe KFT (note: Altegio's own public documents also reference Altegio Limited, Cyprus, as a contracting party; the entity applicable to the Customer's subscription is determined by the Customer's own contract with Altegio) and hosted, per Altegio's documentation, in Hetzner data centres in Germany — processes this data as the Customer's own service provider under the Customer's contract with Altegio. It is a data source and recipient chosen and contracted by the Customer, not a Sub-processor engaged by the Provider. The Customer remains responsible for the lawfulness of the data it holds in Altegio and for its instructions to synchronize that data into the Service.

4.5 Provider's own controller-capacity services

Services that the Provider uses solely in its own controller capacity are not Sub-processors of Customer data. They are not confined to the Provider's public website: they include website and in-product analytics (Google Analytics 4, which runs on the landing pages and inside the signed-in application, subject to consent), the web-font service from which the Service's web applications load their fonts, and Meta's sign-up SDK on the WhatsApp connection screen. Each of these is described in the Cookie Policy (Sections 7.1 and 7.2) and the Privacy Policy.

5. Changes to this list

The Provider will give Customers at least 30 days' advance notice before engaging a new Sub-processor or replacing a listed Sub-processor, by:

1. sending an email to the account or billing contact email address held on the Customer's account; and
2. updating this page (the published Sub-processor List), including the date of the change in the table above and an entry in Section 5.1.

The Customer's right to object to a new Sub-processor, and the consequences of an objection, are governed by the Data Processing Agreement. Where a Sub-processor must be replaced without delay for security or service-continuity reasons, the Provider may do so immediately and will notify Customers as soon as reasonably practicable and no later than the date the replacement takes effect; the Customer's right to object under the Data Processing Agreement applies from that notice.

Removals of Sub-processors and corrections that do not involve a new or replacement Sub-processor may be made by updating this page without advance notice.

5.1 Change history

Each change to the roster is recorded here, so that a Customer can see when a Sub-processor was added and whether the notice period and its objection window have run.

6. Infrastructure jurisdiction statement

This section is the transparency statement referred to in Article 28 of Regulation (EU) 2023/2854 (the Data Act) on the jurisdiction to which the ICT infrastructure deployed for the Service is subject.

The Service's production infrastructure runs in the AWS Frankfurt region (eu-central-1) and is subject to the law of the European Union and its Member States. Several of the vendors listed on this page belong to corporate groups headquartered in the United States; it therefore cannot be excluded that such a group receives a governmental access request that conflicts with Union or Member State law.

The measures the Provider has adopted to prevent international governmental access to, or transfer of, data held in the Union where such access or transfer would create a conflict with Union or Member State law are:

• Location. Workloads are deployed in EU regions, with the exceptions stated in the table above and in Section 3.1.
• Contracts. A data processing agreement with each vendor, and reliance on the EU–US Data Privacy Framework where the recipient holds a current certification, with Standard Contractual Clauses otherwise, for third-country transfers.
• Encryption. Encryption of data in transit (TLS) and at rest. From first production deployment the relational database is encrypted at rest with managed keys, has no public endpoint, and carries deletion protection and a final snapshot on destruction; object storage is encrypted at rest. In addition, all four classes of Channel connection credential — Altegio API credentials, WhatsApp access credentials, Telegram session strings and Instagram page access tokens — are encrypted at field level with AES-256-GCM, and credentials are transmitted to providers in request headers rather than in URL query strings.
• Governmental requests. On receiving a governmental or law-enforcement request for data held for a Customer, the Provider will, where not legally prohibited from doing so: notify the Customer without undue delay; direct the requesting authority to the Customer as controller; disclose only the minimum lawfully required; and challenge requests that are not lawful under Union or Member State law, suspending disclosure while a challenge is pending to the extent the law permits. Where notification is legally prohibited, the Provider will use reasonable efforts to obtain a waiver of the prohibition and will document its assessment. The same duties are owed under Section 11.5 of the Data Processing Agreement.

7. Open verifications — complete and delete this Section before publication

This Section is an internal pre-publication checklist. It gathers every [TO VERIFY] marker in the body; each one is a fact only the operating company can confirm. The list cannot take effect while any marker remains.

Resolved so far: Functional Software, Inc. (Sentry) EU–US DPF self-certification — confirmed against Sentry's published privacy policy, 2026-08-11. MongoDB Atlas region (Frankfurt, eu-central-1) and Sentry EU data residency — confirmed by the operating company, 2026-08-14; entered in the table above. Google — removed from the Service entirely, 2026-08-14; its paid-tier verification item is moot.

8. Contact

Questions about this list or the Provider's Sub-processors:

Elephants Production s.r.o. Rybná 716/24, Staré Město, 110 00 Prague 1, Czech Republic Company ID (IČO): 23397292 Registered in the Commercial Register maintained by the Municipal Court in Prague, File No. C 426391

General inquiries: contact@sended.io Privacy and data protection (including data subject requests): privacy@sended.io