Subprocessor List
Version 3.0
Overview
Eigentum² engages the following third-party service providers (subprocessors) to process personal data on behalf of our customers (controllers) in connection with the provision of the Eigentum² platform.
This list is maintained pursuant to Article 28(2) of the General Data Protection Regulation (GDPR) and § 8 of our Data Processing Agreement (DPA).
For transparency, this page additionally names two parties that are expressly not subprocessors: Google, which acts as a separate and independent controller for the Google Maps Platform, and Meta, with which we act as joint controllers under Article 26 GDPR. Both are listed in separate tables below, kept apart from the subprocessor list so that the distinction is unmistakable.
Current Subprocessors
Infrastructure
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Vercel Inc. | Application hosting, content delivery, serverless compute | EU (Frankfurt) | EU processing; no third-country transfer |
| Neon Inc. | Managed PostgreSQL database hosting with automatic backups | EU (Frankfurt) | EU processing; no third-country transfer |
| Google Cloud Platform (Google LLC) | File and document storage (Firebase Cloud Storage) | EU (Frankfurt) / USA | EU-US Data Privacy Framework; Standard Contractual Clauses |
Authentication
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Google Ireland Ltd. | OAuth authentication (Google Sign-In) | Ireland / USA | EU-US Data Privacy Framework |
Payments
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Stripe, Inc. | Subscription billing and payment processing | USA / Ireland | EU-US Data Privacy Framework; Stripe Ireland acts as EU establishment |
Communication
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Resend (Plus Five Five, Inc.) | Transactional and service email delivery (account, security, billing, sharing, transfer and reminder messages) | USA (EU sending region — Ireland; account data and logs stored in the USA) | EU-US Data Privacy Framework; Standard Contractual Clauses; DPA in place |
AI Services
| Subprocessor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Google Ireland Ltd. (Gemini API) | AI-assisted reading of the loan and financing documents you select, to extract their figures (per API request; not used for model training under the paid API terms) | Ireland / USA | Standard Contractual Clauses; EU-US Data Privacy Framework |
| OpenAI (EEA data processed by OpenAI Ireland Ltd.) | AI-powered property valuation, and AI-assisted reading of loan documents as a substitute or a second reading (per API request; not used for model training under the paid API terms) | Ireland / USA | Standard Contractual Clauses incorporated in OpenAI's data processing addendum |
Loan documents you select are transmitted to these providers in full and unaltered so that their figures can be read. For a property valuation, the internet-search steps receive only the country, city, district, property type, an approximate size and the room count — the street, house number, postcode and coordinates are never part of a search query — while the reasoning step receives the property record we hold, including the full address and the coordinates. Our AI Transparency Notice sets this out field by field.
Google Maps (Separate Controller — Not a Subprocessor)
Under Google's Maps Platform terms, Google is a separate and independent controller for the data it receives, not our processor, so it is not a subprocessor within the meaning of Article 28 GDPR.
| Party | Purpose | Location | Legal instrument |
|---|---|---|---|
| Google Ireland Ltd. / Google LLC | Google Maps Platform: server-side address lookup while an address is being typed, and the map frame shown to a signed-in recipient of a shared property (coordinates and zoom level only) | Ireland / USA | Google Maps Platform Controller-Controller Data Protection Terms; EU-US Data Privacy Framework |
Section 6.2 of our Privacy Policy describes both services and what reaches Google.
Advertising (Joint Controller — Not a Subprocessor)
The party named below is not a subprocessor within the meaning of Article 28 GDPR. It does not process personal data on our behalf and it does not process customer content. It is listed here solely for transparency.
| Party | Purpose | Location | Legal instrument |
|---|---|---|---|
| Meta Platforms Ireland Ltd. | Measurement and targeting of our own advertising on Facebook and Instagram via the Meta Pixel and the Conversions API, on our public marketing pages and checkout page only, and only with the visitor's prior consent | Ireland / USA | Article 26 GDPR joint controllership (Meta Controller Addendum); EU-US Data Privacy Framework; Standard Contractual Clauses |
Registered address: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, D02 AX86, Ireland.
Meta is not a subprocessor within the meaning of Article 28 GDPR and does not process customer content. No data our customers store in the platform — properties, documents, finances, contacts, or tenants — is transmitted to Meta. The Meta Pixel is never loaded inside the authenticated application; it runs only on our public marketing pages and on the checkout page, and only after the visitor has given consent.
The joint controllership is limited to the collection of the data and its transmission to Meta; any subsequent processing by Meta is Meta's sole responsibility. Details are set out in Section 6.6 of our Privacy Policy, and the cookies involved are listed in our Cookie Policy.
Notification of Changes
In accordance with § 8(3) of our Data Processing Agreement, we will notify controllers of any intended addition or replacement of subprocessors at least 30 days before the change takes effect.
The same 30-day advance notice applies to the addition of a joint controller as described under "Advertising."
To receive notifications of changes to this list, please contact us at support@dein-eigentum.de with the subject line "Subscribe to Subprocessor Updates."
Objection Right
If you, as a controller, object to a new subprocessor on reasonable data protection grounds, the parties shall discuss the objection in good faith. If the objection cannot be resolved, you may terminate the service agreement without penalty as of the date the subprocessor change was intended to take effect (§ 8(4) of the DPA).
Further Information
- Data Processing Agreement: Available at https://dein-eigentum.de/legal/dpa
- Privacy Policy: Available at https://dein-eigentum.de/legal/privacy
- Contact: support@dein-eigentum.de
The effective date of this version is displayed above this document.