Sub-processors
Last updated: 2026-10-08
Up-to-date list of sub-processors used by Inger s.r.o. to provide the NISMap service. We publish this document for transparency and in line with Article 28(2) GDPR.
1. What is a sub-processor
A sub-processor is a third party engaged by Inger s.r.o. (as processor) to process personal data on behalf of a customer — for example a hosting, database or payment provider. Under Article 28(2) GDPR, the customer (controller) has the right to be informed of all sub-processors and to raise reasonable objections before they are engaged.
2. Current sub-processors
The following providers are the current sub-processors for the NISMap service. For each one we list the processing purpose, hosting country/region, transfer mechanism outside the EEA (where applicable) and a link to their Data Processing Agreement (DPA).
| Name | Purpose | Country/region | Transfer mechanism | DPA |
|---|---|---|---|---|
| Hetzner Online | Application hosting (Docker, server operated by Inger s.r.o.) | EU (Germany) | EU-hosted | View DPA |
| Supabase | Database, authentication, storage | EU (Frankfurt) | EU-hosted | View DPA |
| Anthropic | AI document generation and answers, questionnaire answer suggestions from an uploaded document (without company identifiers or contact details) | USA | Standard Contractual Clauses (SCCs) | View DPA |
| Stripe | Payment processing | Ireland / USA | SCCs + EU contracting entity (Stripe Payments Europe Ltd.) | View DPA |
| Resend | Transactional email | USA | Standard Contractual Clauses (SCCs) | View DPA |
| PostHog | Cookieless product analytics | EU | EU-hosted | View DPA |
| Cloudflare | DNS, Turnstile (bot protection on forms) | USA | Standard Contractual Clauses (SCCs) | View DPA |
| Sentry | Error tracking and application performance monitoring | EU (Frankfurt) | EU-hosted (sentry.io EU region), PII scrubbing enabled | View DPA |
| Upstash | Rate-limit store (Redis) — only stores aggregated truncated IPs in 1-minute windows | EU (Frankfurt) | EU-hosted, IPs are truncated (/24 IPv4, /64 IPv6) | View DPA |
| Opendata | Public dataset of Slovak and Czech companies (RPO / RPVS / FS / CRZ / OpenSanctions) — ICO lookup for scope engine, vendor auto-audit, relationship graphs | EU (Hetzner, Germany) | EU-hosted (Hetzner, Germany), operated by Inger s.r.o. — only ICO and domain queries are sent, no PII | — |
Before data is sent to the Anthropic Claude API we automatically remove company IDs, company names, emails, phone numbers, IP addresses, birth numbers and recognised personal names and addresses. Names and addresses are recognised heuristically, so some may remain in chat text or an uploaded document. For a document imported into the questionnaire we send Anthropic the document text after this redaction (at most the first 60,000 characters); the file itself is neither stored nor sent.
3. Change notifications
Before engaging a new sub-processor or replacing an existing one, we notify customers at least 30 days in advance — by email to registered users and by updating this page. The last update date is shown at the top of the document.
4. Raising objections
If you have a legitimate data-protection concern about a specific sub-processor, you may object within 30 days of the notice. Send objections to privacy@nismap.com stating the specific reason. If we cannot find an alternative solution, you have the right to terminate the contract without penalty.
Contact
Questions about sub-processors or processing of personal data should be directed to privacy@nismap.com.