Sub-processors Annex
This annex supplements HOSTELELLA's Data Processing Agreement (DPA) and identifies the sub-processors involved when HOSTELELLA processes personal data on the Customer's behalf. The list applies to providers used when the corresponding functionality is enabled in the Customer's environment. HOSTELELLA does not sell personal data. Providers marked as conditional only act when the relevant integration, channel or environment has been configured or enabled by the Customer.
Sub-processor contracts include obligations of confidentiality, security, assistance, return/deletion, sub-contracting and international transfers consistent with Article 28 GDPR. Where a transfer outside the European Economic Area (EEA) occurs, adequacy decisions, Standard Contractual Clauses (SCCs), the EU-US Data Privacy Framework where applicable and supplementary measures will apply.
1. Infrastructure, data and communications sub-processors
| Provider | Status | Purpose | Data processed | Location / transfers |
|---|---|---|---|---|
| Microsoft Ireland Operations Limited / Microsoft Corporation (Microsoft Azure: Azure Functions, API Management, Azure Database for PostgreSQL, Azure Storage, Key Vault, Application Insights, Log Analytics, Azure Static Web Apps, Azure DNS, Azure AI Search, Azure AI Content Understanding and Azure OpenAI Service) | Primary | Cloud infrastructure, backend execution, API gateway, the Service's main database, storage, secrets management, monitoring, search, security, hosting of the web app and the public website, document reading, AI-assisted shift generation and AI features (including Ella). | Account data, application data, documents, metadata, technical logs and data needed to operate the Service. For shift generation, pseudonymized scheduling data (initials, role, department, contract hours and type, availability, shift-band preferences, unavailability date ranges and a minor-age indicator), without full names or the reason or type of absences. For Ella's proactive assistance, the minimal file described in section 11.2 of the Privacy Policy. | Resources created in the European Union (West Europe); data at rest stays in that geography. Data extraction from documents and Ella's proactive assistance use models deployed in the EU data zone. The chat with Ella, AI-assisted shift generation, matching the delivery note against the order, de-duplication and categorization of suppliers and products, other assistance and classification features and, when enabled, the computation of vector representations for search currently use global Azure OpenAI deployments, in which the request may be processed in any region where Microsoft offers the model, including outside the EEA. Possible international support access. All under Microsoft's DPA, SCCs, the EU-US Data Privacy Framework and supplementary measures. Microsoft does not use the data to train models. |
| Microsoft Ireland Operations Limited / Microsoft Corporation (Azure Maps) | Conditional when the business enters or edits its address | Geocoding of the business address (converting the postal address into coordinates) and obtaining its time zone when it is entered or edited, to verify the address and, where the business enables it, for presence verification at clock-in/out. | Business postal address entered by the Customer. No worker location data is sent. | Microsoft's global infrastructure (global Azure Maps service); under Microsoft's DPA, SCCs, the EU-US Data Privacy Framework and applicable safeguards. |
| Microsoft Ireland Operations Limited / Microsoft Corporation (Microsoft 365, Exchange Online) | Primary | HOSTELELLA mailboxes that receive support requests, "Talk to someone" requests, legal communications and internal Service notices. | Contact details, business, role, reason and content of the request, and internal identifiers where the notice includes them. | Microsoft infrastructure; under Microsoft's DPA, SCCs, the EU-US Data Privacy Framework and applicable safeguards. |
| Supabase, Inc. | Primary | Authentication (sign-up, sign-in, access recovery and sessions), auxiliary functions for team invitations and access emails, and a reduced copy of businesses and memberships used for access control. The Service's main database is not hosted on Supabase but on Microsoft Azure. | User identifiers, email, encrypted credentials, session, active business, membership and role in each business, basic business data (name, legal name, tax identifier, address and type), email and role of the invited person and technical authentication metadata. | Project hosted in the European Union (Frankfurt). The provider is a US company: possible support access and sub-processors under DPA, SCCs and applicable safeguards. |
| Resend, Inc. | Primary for necessary email and, when enabled, for optional emails | Account confirmations, team invitations, purchase orders and supplier claims sent by the Customer, support, security notices and Service communications; receipt of the emails and attachments (e.g., invoices and delivery notes) that suppliers send to the business's document-intake address; in addition, when enabled and only with prior consent, Ella's guides and summaries and news, tips and offers. | Email, name where applicable, language, message content, received emails with their attachments and delivery metadata (delivered, bounced, failed, complaint). Open and click measurement may apply only to the team-invitation email where the consent/terminal-access requirements in the Cookies Policy are met; otherwise it is limited to delivery. HOSTELELLA does not provide the suppression list in clear text: it is held as an HMAC fingerprint in the platform. | United States / provider and sub-processor infrastructure; under DPA, SCCs and applicable safeguards. |
| Stripe Payments Europe, Limited and Stripe group entities | Conditional when convertible trials, subscriptions or payments are enabled | Payment processing, payment-method vaulting, billing, tax, fraud prevention, refunds and subscription lifecycle management. | Name, email, billing address, tax identifiers where relevant, customer/payment/subscription references, payment method, order, amount, currency, IP, device and fraud signals. HOSTELELLA does not store PAN or CVC. | EEA, United States and the global network of financial institutions and payment-method providers; under Stripe's DPA and Data Transfers Addendum, SCCs, adequacy decisions, the EU-US Data Privacy Framework where applicable and supplementary measures. |
| Apple Distribution International Ltd. / Apple Inc. (APNs) | Conditional for iOS | Push notification delivery and iOS mobile app operation. | Device tokens, platform, notification preferences, technical metadata and the content of the notification (title and short text). Ella's notifications contain no figures, amounts, percentages or names of people. | Apple's global infrastructure with applicable safeguards. |
| Google Ireland Limited / Google LLC (Firebase Cloud Messaging) | Conditional for Android (on iOS only the SDK is registered; notifications are delivered through APNs) | Push notification delivery and mobile app operation. | Device tokens, platform, notification preferences, technical metadata and the content of the notification (title and short text). Ella's notifications contain no figures, amounts, percentages or names of people. | Google's global infrastructure with DPA, SCCs, EU-US Data Privacy Framework where applicable and safeguards. |
| Cloudflare, Inc. (Turnstile) | Conditional for anti-abuse / captcha | Protection against bots, abuse and automated requests. | Minimal technical data, IP, browser/device signals and verification result. | Cloudflare's global infrastructure with DPA, SCCs, EU-US Data Privacy Framework where applicable and safeguards. |
| Google Ireland Limited / Google LLC (Google Analytics) | Conditional after analytics consent | Aggregated measurement of public website usage when the user accepts analytics cookies. | Analytics identifiers, pages visited, interaction events, technical data and approximate device/browser information. | Google's global infrastructure with DPA, SCCs, EU-US Data Privacy Framework where applicable and prior consent configuration. |
1.1 Other recipients of mobile-payment reports
When an authorized external-purchase program is used, Apple Distribution International Ltd./Apple Inc. or Google Ireland Limited/Google LLC may receive reporting tokens or identifiers, country, amount, currency, date and transaction status to administer the program, security and fees. For these purposes they act under their own terms and responsibilities, not as general sub-processors of HOSTELELLA. Only channel-required data is reported, never PAN or CVC.
1.2 Technical resources of the web app
When the web app opens, the browser downloads the rendering engine and some fonts from Google LLC servers (gstatic.com). Google receives the IP address and technical browser data, but no Customer or account data. It does not act as HOSTELELLA's sub-processor but under its own terms.
2. Artificial intelligence sub-processors
HOSTELELLA relies on AI providers only when the corresponding functionality is enabled (e.g., document extraction and classification, the assistant, or AI-assisted shift generation and labor-framework resolution). Before sending information to these providers, minimization measures are applied: where possible, data is pseudonymized (e.g., the shift generator operates with initials and operational data, not full names) and data not necessary for the purpose is excluded (e.g., the reason for absences is not transmitted).
| Provider | Status | Purpose | Data processed | Location / transfers |
|---|---|---|---|---|
| Anthropic, PBC (Claude models via the Anthropic API) | Conditional when the business resolves the applicable collective agreement or labor framework | Resolution of the applicable labor framework or collective agreement via web search, to support shift configuration. Not used for solely automated decisions. | Country, address and sector of the business. No team data, names, tax identifiers or absences are transmitted. | United States; under Anthropic's DPA / commercial terms, SCCs and supplementary measures. Under its commercial terms, Anthropic does not use data submitted through the commercial API to train its models. |
The web search used to resolve the applicable collective agreement or labor framework is performed with the business's country, address and sector data, without including employees' personal data. AI use is also subject to the Privacy Policy (AI and automated processing section) and the Terms.
Ella, proactive assistance. The messages Ella starts are drafted with Azure OpenAI (Microsoft row in section 1), in an EU data zone deployment. No other AI provider is involved in this processing. The file sent is limited to what is described in section 11.2 of the Privacy Policy and is projected according to the recipient's role.
2.1 Services that receive no personal data
To illustrate the catalogue with product images, the Service queries external image sources (Serper.dev, Open Food Facts and Wikimedia Commons), sending only the product search term. No data about people, the business or its documents is sent, so these services do not act as sub-processors.
3. Changes to the sub-processor list
HOSTELELLA may update this list to maintain, protect or improve the Service. Material changes (including the addition of a new sub-processor) will be communicated at least thirty (30) days in advance where reasonably possible, except for urgent changes due to security, continuity or provider replacement, which will be communicated as soon as feasible. The Customer may object on substantiated data-protection grounds under the DPA by writing to legal@hostelella.com.