List of Sub-processors

This list is an annex to the Data Processing Agreement and the Privacy Policy of the Kontevia service, operated by Eucalypt 4 s.r.o., Company ID 22103741. It names every sub-processor that may process personal data on our behalf, the purpose, the location of processing and the transfer mechanism where processing takes place outside the European Economic Area.

Changes to this list are notified to customers at least 14 days in advance under Article 6.3 of the Data Processing Agreement. Objections can be sent to hello@kontevia.com.

• Railway Corp.: hosting of the database, document storage and application services. Location of data: European Union region. Railway Corp. is established in the United States; any access from there is covered by standard contractual clauses.
• Vercel Inc.: hosting and content delivery of the website and dashboard, performance measurement without cookies. Location: EU edge locations and United States. Transfer mechanism: EU-US Data Privacy Framework and standard contractual clauses.
• Brevo (Sendinblue SAS): transactional and newsletter e-mail delivery. Location: France, European Union.

• Anthropic, PBC: extraction of data from documents, categorisation proposals and the assistant in the dashboard. Location: United States. Transfer mechanism: standard contractual clauses. Data is not used to train models.
• Assistant connectors chosen by the user (OpenAI for ChatGPT, Anthropic for Claude): engaged only when the user connects the account to the assistant; data is transmitted on the user's instruction. Location: United States. Transfer mechanism: EU-US Data Privacy Framework or standard contractual clauses under the provider's terms.

• Meta Platforms Ireland Ltd.: WhatsApp Business API for the chat channel (messages, phone numbers, media sent by the user). Location: Ireland and United States. Transfer mechanism: EU-US Data Privacy Framework and standard contractual clauses.

• Comgate, a.s.: processing of card and bank button payments for subscriptions. Location: Czech Republic, European Union. Card data is processed by Comgate only.
• Bank transaction import: currently available only for bank accounts in Czechia, through the providers listed in the section for customers in Czechia. A pan-European open banking provider will be added to this list before it is engaged.

Google Analytics 4 is deployed and is activated only after consent in the cookie banner. Microsoft Clarity and Google Ads conversion measurement are not deployed at the moment; we will update this list before activating them.

• Google Ireland Ltd.: Google Analytics 4 (deployed, activated only after consent in the cookie banner, retention 14 months) and Google Ads conversion measurement (not deployed). Location: Ireland and United States. Transfer mechanism: EU-US Data Privacy Framework.
• Microsoft Ireland Operations Ltd.: Microsoft Clarity session analytics, activated only after consent. Location: Ireland and United States. Transfer mechanism: EU-US Data Privacy Framework.

• October 2026: Google Analytics 4 deployed on the website and in the advisers directory, only after consent.
• October 2026: Railway Corp. named as the hosting company; Forpsi removed (not used); bank import described as it actually works (Czech banks only); analytics and marketing tools marked as not deployed.
• September 2026: list restructured for the EU-wide service; Railway listed as database hosting; assistant connectors and open banking added.
• March 2026: list created.