Sub-processors
This page lists the third parties that process personal data for IzyShift. It is Annex 3 of our Data Processing Agreement.
- Part A lists sub-processors of our customers' workspace data. For that data we are a processor (see the Privacy Policy).
- Part B lists providers we use for data we hold as controller.
We announce changes to Part A at least 30 days in advance, as described in section 6 of the DPA.
A. Sub-processors of Customer workspace data
| Sub-processor | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH, Gunzenhausen, Germany | Hosting of the application and the database (including shift-note photos) and local backups | All workspace data | EU (Germany and Finland) | None needed (EU) |
| Google (Gmail mailbox of BLACKBREAD LTD; Google Ireland Limited / Google LLC) | Sending service emails: login details and password resets, invitations, deletion confirmations, invoices. Storage of encrypted (AES-256) off-site backup copies, which Google cannot read | Name, email address, email content; encrypted backup files | EU and USA | Google's Standard Contractual Clauses and the EU–US Data Privacy Framework (Google LLC is certified) |
| OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C.) — only if the Customer enables voice shift notes | Speech-to-text for voice messages in shift notes. Audio is sent for transcription and not kept by us. Under OpenAI's API terms, API data is not used to train models and may be kept up to 30 days for abuse monitoring | Voice recording and its text | USA | Standard Contractual Clauses (OpenAI Data Processing Addendum) |
| Telegram (Telegram FZ-LLC / Telegram Messenger Inc.) — only for users who link their Telegram account | Delivering bot messages and notifications (schedules, reminders, approvals) and running the Mini App | Telegram user ID, name, message content | Telegram's data centres, including outside the EEA | Telegram does not offer data processing terms to bot operators. Linking Telegram is optional for every user. The web app, Android app and email work without it. Customers who do not want staff data to pass through Telegram can keep it unlinked |
Not a sub-processor: the Customer's POS. If a Customer connects its POS system (for example Syrve), IzyShift reads sales reports from the Customer's own POS account, using credentials the Customer provides. The POS provider works under its own contract with the Customer and is the Customer's processor, not ours. IzyShift only reads data and never writes to the POS.
B. Providers for data we hold as controller
| Provider | Purpose | Location |
|---|---|---|
| Viva Payment Services S.A. (Viva.com), Greece | Card payments for subscriptions; recurring charges and refunds. Card data is entered on Viva's pages and is never received by us. Viva is an independent controller for payment processing | EU (Greece) |
| European Commission — VIES | Validation of business customers' VAT numbers | EU |
| Hetzner, Google | As in Part A, for our own account, billing and correspondence data | as above |
Last updated: 7 October 2026.