Data protection · Annex 1 to the DPA

Register of sub-processors

Version 1.1 · as of 7 September 2026

This page is the public version of Annex 1 to our data processing agreement under Art. 28 GDPR. It names every provider that processes personal data on our behalf, what for, where, and on what legal basis. Which machine runs what, and how to verify it yourself, is on where patchletter runs.

Where processing takes place

All 6 sub-processors process exclusively within the EU. There is no third-country transfer — and therefore no Standard Contractual Clauses we would have to rely on.

Controller

Company: patchletter UG (haftungsbeschränkt)
Address: Meisterweg 16, 45896 Gelsenkirchen, Germany
Represented by: Kolja Sagorski
Data protection: legal@patchletter.com
Security reports: security@patchletter.com

Sub-processors

netcup GmbH

EU only

Address: Daimlerstraße 25, 76185 Karlsruhe, Deutschland
Register: Amtsgericht Mannheim, HRB 705547
Purpose: Hosting: one server we run ourselves. It runs the application with its database and object storage, error monitoring (Bugsink), analytics (Umami), the stored conversations of the former live chat (Chatwoot), the electronic signing of the DPA (DocuSeal), and the mail server that hands outgoing email to the mailbridge relay and receives incoming bounce and unsubscribe mail.
Categories of data: All application data: email addresses, tracked products, account and billing data, plus log and error data and the recipient addresses of the emails delivered.
Places of processing: Nuremberg, Germany.
Safeguards: A German company processing in Germany. Data processing agreement under Art. 28 GDPR.
Privacy policy: at the provider

Scaleway SAS

EU only

Address: 8, rue de la Ville-l’Évêque, 75008 Paris, Frankreich
Purpose: Authoritative DNS service and registration of the patchletter.com domain — this resolves domain names; no account data and no email content is transmitted. Until 28 September 2026 the provider also carried our hosting; we deleted the data remaining there (servers, database, backups) on 29 September 2026.
Categories of data: For the DNS service, the IP addresses of querying resolvers, as arise with any name resolution.
Places of processing: The provider's name server network (ns0/ns1.dom.scw.cloud); we do not state where its individual nodes are located, because we cannot measure that ourselves.
Safeguards: A French company with no US parent. The provider operates regions exclusively within the EU. Data processing agreement under Art. 28 GDPR.
Privacy policy: at the provider

Heinlein Hosting GmbH (mailbox.org)

EU only

Address: Schwedter Str. 8/9b, 10119 Berlin, Deutschland
Purpose: Mailbox and receipt of incoming email to @patchletter.com addresses, and storage of our off-site backups (database and other services).
Categories of data: Content, senders and attachments of email addressed to us; in the backups the complete data set — but that as ciphertext only.
Places of processing: Berlin, Germany.
Safeguards: A German company processing in Germany. Backups are encrypted client-side (Kopia, AES-256-GCM) before they leave our machine; the provider holds ciphertext only. Data processing agreement under Art. 28 GDPR.
Privacy policy: at the provider

LOGIN SystemHaus GmbH (mailbridge)

EU only

Address: Hagenauer Str. 55, 65203 Wiesbaden, Deutschland
Register: Amtsgericht Wiesbaden, HRB 12713
Purpose: Delivery of all outgoing email via the mailbridge relay — update and security emails as well as sign-in links, invitations and confirmations.
Categories of data: Recipient address and content of the message sent. No click or open tracking — plain SMTP has no such thing.
Places of processing: Germany only.
Safeguards: A German company processing exclusively in Germany. Data processing agreement under Art. 28 GDPR.
Privacy policy: at the provider

IONOS SE

EU only

Address: Elgendorfer Str. 57, 56410 Montabaur, Deutschland
Purpose: A separate machine at a different provider: uptime monitoring of our services (status page) and a second off-site backup of our data.
Categories of data: None for the status page. In the backup the complete data set, stored encrypted.
Places of processing: Berlin, Germany.
Safeguards: A German company processing in Germany. The backup is encrypted (restic, AES-256) before it leaves our server; our server can only add new snapshots there, not delete any. A job on the machine itself removes old snapshots after 30 days. Data processing agreement under Art. 28 GDPR.
Privacy policy: at the provider

Mailjet SAS (Sinch-Gruppe)

EU only

Address: 13-13 bis rue de l’Aubrac, 75012 Paris, Frankreich
Purpose: Standby path for sending. Used only if the regular path fails, and capped at 200 messages a day.
Categories of data: In a fallback: recipient address and content of the message sent.
Places of processing: EU data centres (Frankfurt and Saint-Ghislain).
Safeguards: Processing in EU data centres. It is listed although it is not the regular path: the access is set up and takes over the moment the regular path fails, and naming a processor only once it is actually in use would be naming it too late. Data processing agreement under Art. 28 GDPR.
Privacy policy: at the provider

Deliberately not listed

A gap without a reason reads as an oversight. So here is what is missing, and why.

Our payment providers: They process payment and billing data, for which we are a controller in our own right — they are not sub-processors for the data we handle on your behalf.
Analytics, error monitoring and bot protection: We run Umami and Bugsink ourselves on our own server; the bot-protection challenge (ALTCHA) is issued and verified by the application itself. No third-party service is involved — the host of that server is listed above as netcup in any case.

Changes to this list

Any intended change — a new sub-processor or a switch — is announced in text form to your billing address at least 30 days in advance. Within those 30 days you may object on substantive data protection grounds; if we cannot resolve the objection, you may terminate. The procedure is set out in section 9 of the DPA.