Sub-processors
About this document
We maintain EPPWR application instances on our own infrastructure. For data entered by the client into its instance, we act as a processor — the client is the controller.
We use third parties to provide this service. In accordance with Article 28(2) and (4) of the GDPR, their full list is provided below.
By entering into the agreement, the client gives its general authorisation for our use of these sub-processors. We will give at least 30 days’ advance notice of any intended change — adding a new sub-processor or replacing an existing one — to the email address specified in the agreement. The client may raise a reasoned objection within this period. If no solution can be reached, the client may terminate the instance maintenance agreement with effect from the date of the planned change, while retaining the licence granted.
We have an agreement with each sub-processor imposing data protection obligations no less stringent than those we have undertaken towards the client.
1. Sub-processors handling data in client instances
These entities may potentially access data entered by the client into the application.
| Sub-processor | Role | Processing location | Data covered |
|---|---|---|---|
| Hetzner Online GmbH<br>Industriestr. 25, 91710 Gundelfingen, Germany | Hosting servers running application instances | Falkenstein, Germany (EEA) | All data entered into the instance, backups |
Outgoing application email is handled by the Service Provider’s SMTP server operating on the same infrastructure. We do not use an external email relay provider, so system messages are not sent to any entity not listed in the table above.
If this changes — for example, through the introduction of an external relay to improve deliverability — we will provide notice in accordance with the 30-day rule described above.
2. Artificial intelligence service providers — not included in the list
OpenAI is not our sub-processor.
Application features based on language models operate solely using an API key obtained and entered by the client. The agreement for use of the interface is made directly between the client and OpenAI — we are not a party to it, do not act as an intermediary in the transfer and do not enter into a data processing agreement with OpenAI on the client’s behalf.
In this relationship, the client acts as controller in relation to OpenAI, and the processing terms — including retention, use of data to train models and the basis for transferring data to the United States — arise solely from the client’s agreement with OpenAI.
If the client does not enter an API key, no data from its instance leaves our infrastructure for this purpose.
As a consequence of this arrangement, the client is responsible for entering into a data processing agreement with OpenAI if personal data is transferred through the interface, and for determining the legal basis for its transfer outside the European Economic Area.
3. Recipients of website data
The entities below do not have access to data in client instances. They process data relating to visitors to eppwr.pl and eppwr.eu, and we act as controller in relation to them. They are listed for transparency.
| Entity | Role | Location | Basis for transfer outside the EEA |
|---|---|---|---|
| Hetzner Online GmbH | Website hosting, server logs | EEA | not applicable |
| Google Ireland Limited<br>Gordon House, Barrow Street, Dublin 4, Ireland | Google Analytics — visitor statistics | Ireland, with possible transfer to Google LLC in the USA | EU–US Data Privacy Framework; supplemented by Standard Contractual Clauses |
| Meta Platforms Ireland Limited<br>Merrion Road, Dublin 4, Ireland | Meta Pixel — advertising effectiveness measurement | Ireland, with possible transfer to the USA | EU–US Data Privacy Framework; supplemented by Standard Contractual Clauses |
Analytics and marketing tools are activated only after consent is given for the relevant category of cookies. Until consent is given, these providers’ scripts are not loaded and no requests are sent to their servers.
4. Change history
| Date | Version | Change |
|---|---|---|
| 1 September 2026 | 1.0 | First publication of the list |
Language versions
The list was drawn up in Polish. Versions in other languages are for information only. In the event of any discrepancy between language versions, the Polish version prevails.
Contact
Questions concerning the list and objections to changes should be sent to kontakt@eppwr.pl or raised by telephone: +48 572 892 922.
