List of subprocessors pursuant to Art. 28 GDPR
1. General
Combeenation GmbH (“Processor”) uses subcontractors within the meaning of Art. 28 GDPR to provide the contractually agreed services in connection with the provision and operation of digital product configurators and CPQ solutions.
Subcontractors are only commissioned if this is necessary for technical or organizational service provision. Where required by law, an agreement on order processing in accordance with Art. 28 GDPR is concluded with all subcontractors.
The processor ensures that all subcontractors used have implemented appropriate technical and organizational measures in accordance with Art. 32 GDPR.
2. Subcontractors used
2.1 Microsoft Azure
The provider is Microsoft Corporation or, depending on the contractual arrangement, Microsoft Ireland Operations Limited, based in Ireland.
Microsoft Azure serves as the hosting infrastructure for server operations and includes the storage, processing, and provision of product data, business logic, assets, and end-user input within the configurator.
Processing for EU users is generally carried out within data centers in the European Union. Depending on the technical configuration, transfer to third countries cannot be completely ruled out. In this case, the transfer is carried out on the basis of appropriate safeguards in accordance with Art. 44 ff. GDPR.
2.2 Raygun
The provider is Raygun Limited, based in New Zealand.
Raygun is used for error and performance monitoring purposes. In this context, technical metadata such as IP address, browser information, system data, and error messages may be processed to the extent necessary to ensure the stability and functionality of the system.
2.3 HubSpot
The provider is HubSpot, Inc., based in the USA.
HubSpot is used as a CRM system for project-related management of company and contact data. In particular, company data (company records), contact persons, and project-related communication data are processed to the extent necessary for the performance of the contract.
Data transfer to third countries cannot be ruled out. In this case, the transfer is based on appropriate safeguards in accordance with Art. 44 et seq. GDPR.
2.4 SparkPost
The provider is Bird B.V., based in the Netherlands.
SparkPost is used to send system-generated emails, such as offer or confirmation emails. In particular, it processes email addresses, names (if applicable), and the content of the respective message.
2.5 IPBase
The provider is IPBase.com, based in the USA.
IPBase is used for IP-based geolocation to determine the country, city, or approximate location of the accessing device. The IP address is processed exclusively for the purpose of deriving country information and is not stored. The processor does not carry out any further personal identification of individual end users.
2.6 CloudConvert
The provider is Lunaweb GmbH, based in Germany.
CloudConvert is used to convert image files and generate PDF documents. Depending on the project configuration, content containing personal data may be processed if it is part of the configured documents or image files.