HowToSub-processors and International Data Transfers Notice
This notice supplements our Privacy Policy and our Data Processing Addendum ("DPA"). We expect to update this notice more frequently than our other policies as our vendor list changes; we recommend bookmarking it.
1. Purpose
1.1This notice lists the sub-processors we currently use to provide the HowToRomania Service, their role, their location, and the safeguard that applies to any transfer of personal data outside the European Economic Area ("EEA"). It is provided for transparency to customers and data subjects, and for the specific notice-and-objection mechanism described in our DPA.
2. Current sub-processors
| Sub-processor | Role | Location | Transfer safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Hosting (Workers), database (D1), cache (KV), error logs, DNS, security, bot management | Global network; database (D1) configured to the EU Cloudflare jurisdiction | EU-US Data Privacy Framework and/or Standard Contractual Clauses for any processing outside the EEA |
| Zoho Corporation (Zoho Mail EU) | Business email | EU data centres | Not applicable (EU-based processing) |
| Relay computer operated by us (the operator's own PC in Romania, connected via encrypted Cloudflare Tunnel) | Fetches public-source data reachable only from Romanian IP addresses (court portal, legislation portal, ONRC open-data downloads) | Romania | Not applicable (EU-based processing, operated directly by us) |
| [No further sub-processors as at the effective date of this notice. This table is updated whenever that changes.] | [No further sub-processors as at the effective date of this notice. This table is updated whenever that changes.] | [No further sub-processors as at the effective date of this notice. This table is updated whenever that changes.] | [No further sub-processors as at the effective date of this notice. This table is updated whenever that changes.] |
2.1Stripe (Stripe Payments Europe, Ltd. and affiliates) processes payment data as an independent controller and, for the purchase transaction, as merchant of record; it is not listed here as our sub-processor. ANAF, as the Romanian tax authority, receives invoice content you submit for e-Factura validation and PDF rendering as a recipient acting under its own public-authority responsibilities; it is not listed here as our sub-processor. Both are described further in our Privacy Policy and DPA.
3. Notice of changes and right to object
3.1We will update this notice when we add, remove or replace a sub-processor. For a new sub-processor that will process personal data for which you are the controller under our DPA, we will give you at least 14 days' notice (by updating this notice and, for a material change, by emailing key holders) before the new sub-processor begins processing, so that you may object on reasonable data-protection grounds in accordance with our DPA.
4. Contact
4.1Questions about this notice, or to raise an objection to a new sub-processor: hello@howtoromania.io.