Description: List of subprocessors of the Interactive Paper GmbH
Attached you find a list of all subprocessors of the products and services provided by the Interactive Paper GmbH.
| Subprocessor | Address | Purpose | Mandatory / Optional | Location of data processing | Personal data processed |
|---|---|---|---|---|---|
| Grunewald GmbH | Lindenbergstraße 44, 34123 Kassel, Germany | Production partner / processing of address data for postal dispatch | Optional, only if address data is exchanged | Germany | Address data of end-users |
| MRD GmbH | Siegener Straße 411, 57258 Freudenberg, Germany | Production partner / processing of address data for postal dispatch | Optional, only if address data is exchanged | Germany | Address data of end-users |
| DigitalOcean EU B.V. - Zweigniederlassung Deutschland | Am Sandtorkai 68, 20457 Hamburg, Germany | Hosting and infrastructure services for storing and processing data. | Mandatory | Germany (DigitalOcean Data Center) | Personal Data as determined by the Controller. |
| Artisan Colour | 8970 E Bahia Dr, Scottsdale, AZ 85260, United States | Production partner / processing of address data for postal dispatch | Optional, only if address data is exchanged and mailed out in the United States | United States | Address data of end-users Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914. |
| Stripe, Inc. | 354 Oyster Point Blvd, South San Francisco, CA 94080, United States | Payment processing and subscription billing. Used when a client purchases or renews a paid subscription plan on the letsinteract.com platform. Processes billing name, email, and payment card data. | Mandatory, only if client uses paid subscription | Ireland (EU) — Stripe Payments Europe, Ltd., Dublin. Data stored within EEA. | Billing contact name, email address, payment card data (tokenised), billing address, subscription details. Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914. |
| Google LLC (Google Analytics 4) - optional | 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States | Web analytics and usage tracking for the Creator platform. Collects anonymised usage data (page views, session duration, feature interactions) to understand platform usage patterns. Active whenever a logged-in user interacts with the Creator application. | Only if client enables analytics (location tracking requires explicit client configuration) | European Union (Google EU Data Centre) | Pseudonymised user identifiers, IP addresses (anonymised), browser/device data, page URLs, session and interaction events. Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914. |
| Google LLC (Google OAuth / SSO) | 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States | Single Sign-On (SSO) authentication via Google OAuth 2.0. Used when a platform user chooses to log in to the Creator application using their Google account. Transfers name, email address and Google account identifier upon login. | Optional, only if user selects Google login | European Union (Google EU Data Centre) | Name, email address, Google account identifier. Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914. |
| LinkedIn Corporation | 1000 West Maude Avenue, Sunnyvale, CA 94085, United States | Single Sign-On (SSO) authentication via LinkedIn OAuth 2.0. Used when a platform user chooses to log in to the Creator application using their LinkedIn account. Transfers name, email address and LinkedIn profile ID upon login. | Optional, only if user selects LinkedIn login | United States | Name, email address, LinkedIn profile identifier. Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914. |
| Microsoft Corporation (Azure AD / Entra ID) | One Microsoft Way, Redmond, WA 98052, United States | Enterprise Single Sign-On via Microsoft Azure Active Directory (Entra ID). Used when a corporate user logs in to the Creator application using their company Microsoft account. Primarily used by enterprise clients with Microsoft 365 tenants. | Optional, only if user selects Microsoft/Azure AD login | United States (EU data residency available via Microsoft EU Data Boundary) | Name, email address, Microsoft/Azure AD account identifier, tenant ID. Transfer basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914. |
| HubSpot, Inc. | 25 First Street, Cambridge, MA 02141, United States (EU data hosted in Germany via HubSpot EU Data Centre) | CRM and customer account management. Stores client contact details, company information, deal history, and communication records for Interactive Paper's sales and account management operations. | Mandatory (for clients whose data is stored in CRM) | European Union (Germany — HubSpot EU Data Centre) | Client company name, billing contact name, email address, phone number, deal information, communication history. No transfer outside the EEA — no SCCs required. |
| Cloudflare, Inc. | 101 Townsend Street, San Francisco, CA 94107, United States | Reverse proxy, CDN, Web Application Firewall (WAF) and DDoS protection. All web traffic to the letsinteract.com platform and campaign landing pages is routed through Cloudflare's network before reaching the hosting infrastructure. | Mandatory | Global edge network; requests are processed at the Cloudflare data centre closest to the visitor (EU data centres for visitors in the EU). Application data at rest remains with DigitalOcean (Germany). | IP addresses, HTTP request metadata (URL, headers, user agent), security and traffic logs. Transfer basis: EU-US Data Privacy Framework and EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914. |
| ClickHouse, Inc. (ClickHouse Cloud) | c/o Goodwin Procter LLP, 601 Marshall St, Redwood City, CA 94063, United States | Analytics database (ClickHouse Cloud) for storing and evaluating campaign interaction and usage data that powers the campaign reports on the letsinteract.com platform. Runs on Amazon Web Services infrastructure operated on behalf of ClickHouse. | Mandatory | Germany (EU) — AWS region eu-central-1, Frankfurt | Pseudonymised end-user identifiers (incl. personalisation ID in personalised campaigns), interaction and event data, device/browser data (OS, browser, device brand and model, browser language), approximate location (country, region, city), consent flags. Transfer basis: EU-US Data Privacy Framework and EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), Commission Decision 2021/914. |
Note on optional sub-processors: Sub-processors marked as optional are only engaged if the respective feature or service is used. Single sign-on providers (Google, LinkedIn, Microsoft) are only involved if a platform user chooses to log in with the respective account; other login methods are always available. HubSpot is used for Interactive Paper's own customer relationship management (sales and account management). Production partners are only involved if address data is exchanged for postal dispatch: by default, mailings are handled by Grunewald GmbH; MRD GmbH is only involved if a mailing is sent via MRD, and Artisan Colour only for mailings within the United States.