Sub-processors
As of October 17, 2026
To provide the service, Sosta uses the following sub-processors under Art. 28 GDPR. With each of them there is a contract that meets the requirements of Art. 28 GDPR; for transfers to third countries, appropriate safeguards (in particular the EU Standard Contractual Clauses) are agreed. Setcard content (profiles, photos) stays on EU infrastructure.
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Hostinger Operations UAB | Application and database hosting | Frankfurt am Main, Germany (EU) | processing in the EU |
| MinIO (selbst betrieben) | Object storage for images (setcard and profile photos) | Our own EU infrastructure | processing in the EU, no transfer to third countries |
| Contabo GmbH | Encrypted backup storage | Germany (EU) | processing in the EU |
| Plus Five Five, Inc. (»Resend«) | Delivery of transactional emails | USA | EU-U.S. Data Privacy Framework; EU Standard Contractual Clauses (SCC Module 2) as a fallback |
| Mapbox | Map preview images (city header, tour planning preview) and turning place searches and rounded location coordinates into place names (geocoding) | USA | EU-U.S. Data Privacy Framework with SCC Module 2 as a fallback. Geocoding requests are sent server-side via api.sosta.app (no end-user IP address), with coordinates rounded to about 1.1 km beforehand. The static map preview images are loaded by your browser directly from api.mapbox.com, which means your IP address is transmitted |
| CARTO | Base map tiles for the interactive directory and Talents map | USA / Spain | EU Standard Contractual Clauses (SCC) |
| OpenStreetMap Foundation (»Nominatim«) | Conversion of public establishment addresses into coordinates when maintaining the directory (by hand, not during operation) | United Kingdom | European Commission adequacy decision for the United Kingdom; server-to-server only, no end-user data and no end-user IP address |
| Umami (selbst betrieben) | Cookie-free audience statistics | Our own EU infrastructure (analytics.alpin-code.de) | processing in the EU, no transfer to third countries, no personal profiles |
| seven communications GmbH (»seven.io«) | Sending text messages to verify talents' phone numbers (one-time confirmation code) | Düsseldorf, Germany (EU) | processing in the EU |
| GlitchTip (selbst betrieben) | Technical error monitoring (with personal data removed) | Our own EU infrastructure | processing in the EU, no transfer to third countries |
- Hostinger Operations UABFrankfurt am Main, Germany (EU)
Application and database hosting
Safeguard: processing in the EU
- MinIO (selbst betrieben)Our own EU infrastructure
Object storage for images (setcard and profile photos)
Safeguard: processing in the EU, no transfer to third countries
- Contabo GmbHGermany (EU)
Encrypted backup storage
Safeguard: processing in the EU
- Plus Five Five, Inc. (»Resend«)USA
Delivery of transactional emails
Safeguard: EU-U.S. Data Privacy Framework; EU Standard Contractual Clauses (SCC Module 2) as a fallback
- MapboxUSA
Map preview images (city header, tour planning preview) and turning place searches and rounded location coordinates into place names (geocoding)
Safeguard: EU-U.S. Data Privacy Framework with SCC Module 2 as a fallback. Geocoding requests are sent server-side via api.sosta.app (no end-user IP address), with coordinates rounded to about 1.1 km beforehand. The static map preview images are loaded by your browser directly from api.mapbox.com, which means your IP address is transmitted
- CARTOUSA / Spain
Base map tiles for the interactive directory and Talents map
Safeguard: EU Standard Contractual Clauses (SCC)
- OpenStreetMap Foundation (»Nominatim«)United Kingdom
Conversion of public establishment addresses into coordinates when maintaining the directory (by hand, not during operation)
Safeguard: European Commission adequacy decision for the United Kingdom; server-to-server only, no end-user data and no end-user IP address
- Umami (selbst betrieben)Our own EU infrastructure (analytics.alpin-code.de)
Cookie-free audience statistics
Safeguard: processing in the EU, no transfer to third countries, no personal profiles
- seven communications GmbH (»seven.io«)Düsseldorf, Germany (EU)
Sending text messages to verify talents' phone numbers (one-time confirmation code)
Safeguard: processing in the EU
- GlitchTip (selbst betrieben)Our own EU infrastructure
Technical error monitoring (with personal data removed)
Safeguard: processing in the EU, no transfer to third countries
Changes
Sosta informs establishments (controllers) in text form about intended changes (adding or replacing a sub-processor); they can object for an important data protection reason. This list is part of the transparency overview and corresponds to Annex 2 of the data processing agreement (DPA) under Art. 28 GDPR.
This disclosure is kept up to date. Questions about data protection: datenschutz@sosta.app