Sub-processor Directory
As of: April 2026
Controller
NLTS Global Analytics s.r.o.
Malá 43/6, 301 00 Pilsen, CZ
1. Introduction
In accordance with Art. 28(2) GDPR, we hereby inform you about the sub-processors engaged in the provision of our services who may process or access personal data. Changes to this directory will be communicated with 30 days’ prior notice.
2. Sub-processor Directory
| Company | Purpose | Location | Safeguards |
|---|---|---|---|
| DigitalOcean LLC (via Cloudways/Vultr) |
Server hosting, infrastructure | Frankfurt am Main, DE (EU) | DPA, ISO 27001, SOC 2 Type II |
| Cloudflare Inc. | CDN, DDoS protection, WAF, DNS | Global network (Anycast), HQ: San Francisco, USA | EU-SCCs, ISO 27001, SOC 2 |
| Anthropic PBC | AI expert opinion (Claude API) — only when explicitly activated by the client | San Francisco, USA | EU SCCs, SOC 2. Usage optional. No automatic data transfer. |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payment processing (single purchase) | Luxemburg, EU | EU-based, GDPR-compliant. Art. 6(1)(b) GDPR. |
| Billogram AB | Invoicing & monitoring subscriptions | Stockholm, Schweden, EU | EU-based, data processing agreement Art. 28 GDPR. |
| Postmark (ActiveCampaign LLC) |
Transactional emails (scan notifications, magic links) | USA | EU-SCCs, SOC 2 |
3. Note on Third-Country Transfers
EU Standard Contractual Clauses (SCCs) pursuant to Implementing Decision 2021/914 are in place for all US-based sub-processors. Supplementary measures: TLS encryption, data transfer minimisation.
4. Note on Anthropic (AI Feature)
Use of the AI feature (expert opinion, tracker classification) is optional. When activated, only technical website data (no personal data) is transmitted to the Claude API. Public authorities may disable the AI feature.
5. Contact
Change notifications and objections to: [email protected]
As of: April 2026