Skip to content

Sub-processors

Last updated: 25 November 2025

About this page

A sub-processor is a third-party service provider that Qaxal s.r.o. ("Qaxal", "we") engages to help operate the Digital Identity Platform ("DIP"). Where those providers handle personal data belonging to our customers' end users and flowing through DIP (Customer Personal Data), they do so on our instructions and under a written data-processing agreement.

This page is the canonical, public list. It is referenced from our Data Processing Agreement and our Privacy Policy.

Scope of this page: Customer Personal Data processed via the DIP service. It does not cover end-user data that customers choose to send onward to their own marketing or analytics tools; see "What this page does not cover" below.

Section A: Sub-processors for Customer Personal Data processed via the DIP service

These are the "real" sub-processors under the DPA. They process Customer Personal Data flowing through the DIP service on Qaxal's instructions.

Sub-processor Role Categories of Personal Data Processing location Transfer mechanism (if outside EEA)
Cloudflare Germany GmbH (backstop: Cloudflare, Inc., US) DIP runtime (Workers), event and configuration storage (R2), DDoS protection, WAF, DNS for first-party endpoints All event payloads through the customer's container: online identifiers (_qid, _qs, _qconsent), click identifiers, IP address (truncated at edge by default), session and device metadata, hashed contact identifiers where customer tags transmit them, consent state EU edge (Germany, Netherlands, France); global anycast fallback EU Standard Contractual Clauses (Module 3) under the Cloudflare DPA; Cloudflare, Inc. is EU-U.S. DPF certified
Google Cloud EMEA Limited (backstop: Google LLC, US) Stores and queries the customer's raw event-log warehouse on BigQuery Event payloads streamed from the container into BigQuery, retained per the DPA (default 14 months) EU region (europe-west1 or europe-west3, per customer election) EU Standard Contractual Clauses (Module 3) under the Google Cloud DPST; Google LLC is EU-U.S. DPF certified

Qaxal does not currently engage a dedicated transactional email or customer-support sub-processor that processes Customer Personal Data. If we engage one, we will update this page and provide at least 30 days' advance notice as set out in the DPA.

Section B: Other vendors Qaxal uses (Controller-side, for Qaxal's own operations)

These vendors do not process Customer Personal Data through the DIP service. They process data that Qaxal collects in its own role as a controller (for example, billing contact data or business correspondence with the Customer's representatives). They are listed here for full transparency, but they are not sub-processors under the DPA.

Vendor Role Categories of Personal Data Processing location Transfer mechanism (if outside EEA)
Stripe Payments Europe, Limited (Ireland; backstop: Stripe, Inc., US) Subscription billing and invoicing for Qaxal customer accounts Billing-contact data only: name, business email, billing address, VAT number, payment-method tokens. No end-user container data Ireland, with limited US access for support and fraud control EU Standard Contractual Clauses under the Stripe DPA; Stripe, Inc. is EU-U.S. DPF certified
Google Ireland Limited (Google Workspace; backstop: Google LLC, US) Business email used by Qaxal personnel to correspond with customers about the service Business correspondence: contact name, business email, message content Ireland; US vendor support EU Standard Contractual Clauses under the Google Workspace DPA; Google LLC is EU-U.S. DPF certified

For the full text of the EU Standard Contractual Clauses, see the European Commission's page on standard contractual clauses for international transfers.

We use additional internal collaboration and productivity tools (for example team chat, task management, and generative-AI tooling used by our personnel) that do not process Customer Personal Data flowing through DIP. They handle limited internal correspondence and operational data and are described in our Privacy Policy.

What this page does not cover: customer-configured destinations

DIP lets each customer forward event payloads from their container to third-party marketing, advertising, and analytics platforms, for example Meta Conversions API, Google Ads, Google Analytics 4, LinkedIn Conversions API, Bloomreach, and similar tools the customer enables in their container configuration.

These destinations are not sub-processors of Qaxal. The customer chooses them, holds the contractual relationship directly with each platform under that platform's own terms, and is responsible for executing any required international transfer mechanism with them. On receipt of forwarded data, each destination acts as an independent controller (or, where the destination offers a processor-mode product the customer separately elects, as the customer's own processor). Qaxal's role is limited to forwarding event payloads on the customer's documented instruction.

Customers mapping their own data flows should track these destinations in their own records of processing, not against this page.

Changes to this list

This change-notice obligation applies to additions or replacements of Section A sub-processors, since those are the ones materially within the DPA's scope.

We notify Customers of changes to Section A sub-processors by emailing the address Customer has provided for legal notices in their account, at least 30 days before the change takes effect. Customers may additionally subscribe to legal@qaxal.com to receive sub-processor change notices on a general list, in addition to the legal-notice email.

We aim to give Customers reasonable notice of material changes to Section B vendors as well, but the formal 30-day DPA notice does not apply to that section.

Customers may object to a proposed new or replacement Section A sub-processor on reasonable grounds related to data protection by writing to legal@qaxal.com within 30 days of the notice. The objection process, the resolution mechanism, and the customer's remedy if no resolution can be reached are governed by the Data Processing Agreement.

Contact

For all of the following, write to legal@qaxal.com:

  • Subscribing to or unsubscribing from sub-processor change notifications. Use subject line subscribe subprocessor-changes or unsubscribe subprocessor-changes and include the corporate domain and contact name.
  • Objecting to a new or replacement sub-processor.
  • Any questions about this page.

Qaxal s.r.o., Ulica Adama Štrekára 8131/19, 917 08 Trnava, Slovak Republic. IČO 55 900 526. DIČ 2122126281. VAT ID SK2122126281. Registered: OR Okresného súdu Trnava, oddiel Sro, vložka č. 55543/T.

Last updated: 29 May 2026