Version 24 September 2026
1.1 In this document the following terms have the following meanings. Capitalised terms not defined here have the meanings given in the Privacy Policy and the DPA.
1.2 This document is the Subprocessor List referred to in the Privacy Policy and the DPA, and is Schedule 3 of the DPA.
| # | Subprocessor | Service | Personal Data Processed | Processes Customer Content | Location of Processing | Transfer Mechanism | Contract |
|---|---|---|---|---|---|---|---|
| 2.1 | Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany | Rental of server infrastructure in a data centre, on which the Production Database and the copies of it taken on the production server are held | All Personal Data stored in the Service: Account Data, Security Data, Activity Records, Customer Content, Measurement Data, Consent Records, Server Log Data, service fault records, and copies of them | Yes | Finland (European Economic Area) | Not required | Data processing agreement of Hetzner Online GmbH, version 1.1 of 10 February 2025, accepted on the day the server account was opened |
| 2.2 | the Google entity named in the operator's own agreement (Google Workspace) | Delivery of Service Communications by email; hosting of the Company's mailboxes, including the Contact Email | Email addresses of recipients and the content of Service Communications, including sign-in codes and the description of the browser, operating system and device class of a sign-in; Correspondence Data; message logs | No, save for Customer Content that a Customer or Authorised User sends to the Company by email | United States and other countries in which Google operates facilities | EU-U.S. Data Privacy Framework certification of Google LLC; standard contractual clauses where they apply under the Google Cloud Data Processing Addendum | Google Cloud Data Processing Addendum, version of the version in force when that account was opened, accepted on the day the mail account was opened |
2.3 Each contract in the column "Contract" was concluded by the Company. A contract concluded before the incorporation of Pallarium is transferred to it, or concluded again by it, on its incorporation, and this document is updated accordingly.
3.1 Hetzner Online GmbH provides the data centre in Finland through its subcontractor Hetzner Finland Oy, Huurrekuja 10, 04360 Tuusula, Finland (building rental and technical support). Under its data processing agreement, Hetzner Online GmbH processes data exclusively in a Member State of the European Union or of the European Economic Area unless the Company consents in advance to a transfer to a third country.
3.2 Google engages its own subprocessors for Google Workspace, as identified in the list of subprocessors that Google publishes for that service.
4.1 The following do not receive Personal Data of Users from the Company and are not Subprocessors:
(a) the provider of the offline database used on the Company's server to associate a truncated IP address with a country, which is held and queried on the Company's server and to which no data is transmitted;
(b) the domain name registrar and the authoritative domain name service of the Site;
(c) the certificate authority that issues the Site's TLS certificates; and
(d) suppliers named in the supplier directory, and any other person to whom a User sends a document generated by the Service on the User's own initiative.
4.2 Encrypted copies of the Production Database held outside the production server are held by the Company itself, on equipment used exclusively by its authorised personnel, located in the country the operator works from, and not by any Subprocessor.
4.3 The Site and the Service do not use third-party analytics, advertising, content delivery, font, tag management, session recording, screening or customer support services.
4.4 When paid plans become available, payments will be processed by the payment provider named at checkout, which will act as an independent controller of payment card data and payment data for its own purposes, and as processor of the Company for any other purpose. This document will be updated before the payment provider named at checkout Processes any Personal Data.
5.1 The Company gives notice of any intended addition or replacement of a Subprocessor by updating this document and by email to the email address of each Account at least thirty (30) days before the new Subprocessor begins Processing Personal Data, save as provided in the DPA for changes necessary to maintain the security, integrity or availability of the Service.
5.2 A Customer may object to a new Subprocessor Processing Customer Content in accordance with Section 7.4 of the DPA.
5.3 Earlier versions of this document are available on request to the Contact Email.
6.1 Pallarium, hello@pallarium.com; before its incorporation, the founder of Pallarium. Contact Email: [CONTACT EMAIL = hello@pallarium.com].