Sub-processors
Last updated: 2026-10-14.
These are the companies that process personal data for Pandus: for our own purposes under the Privacy policy, and on behalf of our customers under the Data processing agreement. We announce a new or replaced sub-processor on this page and by e-mail to the owners of customer teams at least 14 days before it starts.
Sub-processors
| Company | What it does for us | Where the data is | Transfer safeguard |
|---|---|---|---|
| Hosting provider | Servers, database, files and backups of the Service | European Union | Not needed: the data stays in the EU |
| Cloudflare, Inc. (USA) | Every request to the website passes through its network: delivery and protection against attacks; Turnstile, the check that a form is sent by a person | Cloudflare's global network, nearest location to the visitor | EU–US Data Privacy Framework; standard contractual clauses in Cloudflare's data processing addendum |
| Functional Software, Inc. — Sentry (USA) | Error reports, set up without personal data | EU data region (Frankfurt, Germany) | Data stored in the EU; the company is certified under the EU–US Data Privacy Framework |
| Google Ireland Ltd (Ireland), Google LLC (USA) | Google Analytics 4 statistics; in the EEA, the UK and Switzerland only with your consent | EU and USA | EU–US Data Privacy Framework; standard contractual clauses |
| Microsoft Ireland Operations Ltd (Ireland), Microsoft Corporation (USA) | Microsoft Clarity session recordings and heatmaps; in the EEA, the UK and Switzerland only with your consent | EU and USA | EU–US Data Privacy Framework; standard contractual clauses |
Customer data (checks, screenshots, reports, barrier reports) is processed only by the hosting provider. Cloudflare passes it through on the way to your browser. Clarity hides the text of the customer area and of form fields, and neither Google nor Microsoft receives your e-mail or name.
Our own staff access the servers from Ukraine. The European Commission has not adopted an adequacy decision for Ukraine; for customers in the EEA the standard contractual clauses in section 11 of the Data processing agreement apply.
Separate controllers
These companies receive data only when you use their service. They decide for themselves how to process it, under their own privacy notices; they are not our sub-processors.
| Company | When | Where |
|---|---|---|
| Paddle.com Market Ltd (United Kingdom) | Card payments: Paddle is the Merchant of Record and seller of the order | United Kingdom (adequacy decision of the European Commission) |
| The sign-in provider you choose: Google, Microsoft, GitHub, GitLab, LinkedIn, Facebook or Apple | Only if you use its “Continue with …” button | Under that provider's notice |
| Telegram | Only if you connect our Telegram bot to receive alerts | Under Telegram's notice |
Not a sub-processor
- E-mail is sent by our own mail server, not by an e-mail service company.
- Country detection uses the DB-IP.com database (CC BY 4.0) on our own server; IP addresses are not sent anywhere for this.
- Checks and PDF reports are made by our own scanner and PDF service, not by an outside company.
Questions: vadym.queensoft@gmail.com.
Changes
| Date | Change |
|---|---|
| 2026-10-14 | First published list |