Sub-processors
This page lists the current sub-processors Salonnare (VanIersel Development) relies on to deliver the SaaS platform. A data processing agreement (DPA) with EU Standard Contractual Clauses (SCC) is in place with each, and/or the processor is certified under the EU-US Data Privacy Framework (DPF), in accordance with Articles 28 and 46 GDPR. Changes are announced at least 30 days in advance via this page and by email to paying customers.
| Sub-processor | Location | Purpose / service | Data categories | Transfer mechanism | Certifications | DPA |
|---|---|---|---|---|---|---|
| STRATO AG | Duitsland / Germany | VPS hosting (production server) | Full application data (encrypted at rest) | EU | ISO 27001 | DPA → |
| Cloudflare, Inc. | EU edge / USA | CDN, WAF, DDoS protection, DNS | IP address, request metadata | SCC + DPF | ISO 27001, SOC 2 Type II, ISO 27018 | DPA → |
| Stripe Payments Europe Ltd. | Ierland / Ireland (EU + USA via SCC) | Subscription billing and Stripe Connect (tenant payments) | Name, email, billing details, card/IBAN (encrypted by Stripe) | SCC | PCI-DSS Level 1, SOC 2 Type II, ISO 27001 | DPA → |
| Mollie B.V. | Nederland / Netherlands | Tenant payments (iDEAL, Bancontact, SEPA) | Payment details, name, email | EU | PCI-DSS Level 1, ISO 27001 | DPA → |
| Resend, Inc. | EU regio + USA | Transactional email | Name, email address, message content | SCC | SOC 2 Type II | DPA → |
| Anthropic PBC | USA | Claude Code (development-time only, no runtime link to customer data) | No customer data - source code + developer prompts only | SCC | SOC 2 Type II | DPA → |
| Google Ireland Ltd. (Analytics + Ads) | Ierland / Ireland + USA | Google Analytics 4 + Google Ads conversion tracking + Places API (marketing site salonnare.com and help.salonnare.com only) | Anonymised IP, GA4 cookies, Google Ads cookies (AW-conversion), device, pageviews, address lookup, conversion events | SCC + DPF | ISO 27001, SOC 2 Type II, ISO 27018 | DPA → |
| Google Ireland Ltd. (Reserve with Google) | Ierland / Ireland + USA | Google Reserve / Reserve with Google (opt-in per tenant) | Booking metadata from tenants who enable this feature | SCC + DPF | ISO 27001, SOC 2 Type II | DPA → |
| Microsoft Ireland Operations Ltd. (Clarity) | Ierland / Ireland + USA | Optional UX analytics (heatmaps, session replay) | Pseudonymised click/scroll events, masked session video | SCC + DPF | ISO 27001, SOC 2 Type II, ISO 27018 | DPA → |
| Meta Platforms Ireland Ltd. | Ierland / Ireland + USA | WhatsApp Business Cloud API (optional per tenant) | Phone number, message content | SCC + DPF | ISO 27001, SOC 2 Type II | DPA → |
| MJML.io | Frankrijk / France | Server-side HTML rendering for email campaigns | Template markup only, no personal data | EU | - | DPA → |
| Backblaze, Inc. / AWS EMEA Sà rl | USA / Luxemburg | Encrypted off-site backups (optional) | Full encrypted database dumps | SCC + DPF | ISO 27001, SOC 2 Type II | DPA → |
Mollie: independent controller
As a payment service provider, Mollie B.V. takes the formal position that it is not a processor within the meaning of Article 28 GDPR, but an independent controller for the payment data of tenants and their customers. We therefore do not enter into a data processing agreement with Mollie; the relationship is governed by Mollie's own privacy statement. Mollie is included in this list for full transparency about the parties that receive data when a tenant processes payments through Mollie.
Not a sub-processor: Knab
Knab N.V. (Netherlands) is the business bank account of VanIersel Development and is used solely for our own invoicing and VAT administration. Knab does not process any data from Salonnare tenants and therefore is not a sub-processor within the meaning of Article 28 GDPR. Tenant payments are processed exclusively via Stripe and Mollie (see table above).
Changes to this list (adding or replacing a sub-processor) are announced at least 30 days before engagement via email to the primary contact of each paying customer and published on this page. During those 30 days you may object with reasoning; if the objection cannot be resolved, you have the right to terminate the agreement without notice (see section 6 of our DPA).
To subscribe to changes, email "Subscribe sub-processor updates" to [email protected]. You will then receive every change directly in your inbox.
Questions, objection or want a copy of a DPA? Email [email protected].