Subprocessors
Last updated: April 2026
suPlay B.V. uses the following subprocessors to operate suPlayPoll. Each has a signed Data Processing Agreement (DPA) on file or a publicly-referenced DPA we have accepted. When we add or replace a subprocessor, we notify customers by email at least 30 days before the change takes effect.
Current subprocessors
| Subprocessor | Purpose | Data processed | Location | Legal basis for transfer |
|---|---|---|---|---|
| TransIP / team.blue transip.nl | Hosting, compute, primary storage | All application data (database, files, logs) | Netherlands (EU) | EU — no transfer mechanism required |
| Resend resend.com | Transactional email delivery (verification, password reset, invitations, billing) | Recipient email, name, email body | EU (eu-west-1) | EU — no transfer mechanism required |
| Sentry (Functional Software Inc.) sentry.io | Application error monitoring | Error stack traces and technical context. Personally-identifying fields are scrubbed before transmission (sendDefaultPii: false + beforeSend filter). No vote content is sent. | United States* | EU Standard Contractual Clauses (SCCs) |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. paypal.com | Subscription billing, payment processing, webhook notifications | PayPal payer ID, subscription ID, plan ID, billing status. Card or bank details are entered on PayPal directly and never touch our systems. | Luxembourg (EU) with US parent | EU entity; SCCs for any onward US transfer |
| Scaleway S.A.S. scaleway.com | Encrypted off-site backup storage (Object Storage, nl-ams region) | Encrypted PostgreSQL database snapshots (GPG AES-256 symmetric). Key is held by suPlay B.V. only; Scaleway cannot decrypt. | Netherlands / France (EU) | EU — no transfer mechanism required |
* We plan to move Sentry ingestion to the EU region (*.ingest.de.sentry.io) to eliminate the transatlantic transfer. Track status in our changelog.
Self-hosted services (not subprocessors)
A primary application database, a short-lived cache / coordination layer, and an optional on-premises large-language model for administrator-only question suggestions are all operated by suPlay B.V. on infrastructure in the Netherlands. These components are not third-party subprocessors. No participant or presenter personal data is sent to the language model — only question templates.
Subprocessor change notifications
If you have signed a Data Processing Agreement with us, we will email your contact at least 30 days before adding or replacing any subprocessor. You may object within that period; if the objection cannot be resolved, you may terminate the affected subscription pro-rata.
Questions or DPA requests: privacy@suplay.nl.