Sub-processors
Last updated: 19 April 2026
1. Overview
A "sub-processor" is a third party engaged by orkestr (WhiteCloud Project S.R.L.) to process personal data on our behalf in the course of providing the Service. We publish and maintain this list as part of our GDPR obligations under Article 28 and as a commitment to transparency.
All sub-processors are bound by a written data processing agreement (DPA) that imposes data protection obligations equivalent to those we owe our customers. Where a sub-processor is located outside the EU/EEA, we rely on a valid transfer mechanism (adequacy decision or Standard Contractual Clauses) as required by GDPR Chapter V.
2. Current sub-processors
| Sub-processor | Purpose | Location | Transfer basis | Privacy / DPA |
|---|---|---|---|---|
Hetzner Hetzner Online GmbH | Compute, storage, and network for user applications, serverless functions, and managed add-ons (Postgres, Redis). | Germany (Nuremberg, Falkenstein) and Finland (Helsinki) | EU/EEA - no extra-EU transfer | Open |
Bunny BunnyWay d.o.o. | CDN, edge caching, DNS, and DDoS mitigation for orkestr.eu and deployed user applications. | Slovenia | EU/EEA - no extra-EU transfer | Open |
Mollie Mollie B.V. | Payment processing and subscription billing for paid plans. | Netherlands | EU/EEA - no extra-EU transfer | Open |
Brevo Brevo SAS | Transactional email delivery (account notifications, billing receipts, password resets). | France | EU/EEA - no extra-EU transfer | Open |
3. Changes to sub-processors
We will notify customers on paid plans of any intended addition, replacement, or removal of a sub-processor with at least 30 days' advance notice by email and by updating this page. Customers may object to a new sub-processor on reasonable data protection grounds during the notice period.
If the objection cannot be resolved, the customer may terminate the affected part of the Service and receive a pro-rata refund for any prepaid, unused fees.
4. Data Processing Agreement
Our Article 28 GDPR Data Processing Agreement is published at orkestr.eu/dpa and is incorporated by reference into every subscription. It contains the flow-down terms we impose on the sub-processors listed above, the change-notice procedure, and your right to object. Customers can generate a counter-signed PDF with their own details from Settings → DPA in the console.
5. Contact
To subscribe to sub-processor change notifications or object to a sub-processor, contact legal@orkestr.eu.