GDPR Article 28(3)(d) Subprocessor Register
Authorized Subprocessors
This register lists only providers actually enabled for production processing. The production infrastructure and transactional-email providers must be selected and added here before real personal data is processed.
Pre-deployment register • Infrastructure provider not yet selected
Notice of Subprocessor Modifications (30-Day Policy)
taakflow provides registered Hosts with at least thirty (30) calendar days advance notice via email before onboarding any new subprocessor. Hosts maintain the right under our DPA to object within fourteen (14) calendar days on legitimate data protection grounds.
Stripe Payments Europe, Ltd.
• Card Payment Processing & Stripe ConnectLocation: Dublin, Ireland / European Union
Transfer Basis: Licensed payment institution in Ireland (EU). Guest payments flow directly to host accounts.
Data Processed: Cardholder payment transactions, Stripe Connect connected accounts, payout reconciliation.
Resend Inc.
• Optional Transactional Email Delivery (Resend alternative)Location: United States (Global delivery network)
Transfer Basis: Dormant by default. Review the provider DPA and applicable international-transfer mechanism before enabling production processing.
Data Processed: Recipient email address, OTP authentication codes, payment notifications only when Resend is enabled.
Twilio Inc.
• SMS OTP DeliveryLocation: United States / EU (Dormant in Free Beta)
Transfer Basis: Dormant in Free Beta. Standard Contractual Clauses (SCCs) when active.
Data Processed: Phone number for SMS 2FA / verification.
Meta Platforms Ireland Ltd.
• WhatsApp Business API NotificationsLocation: Ireland / EU (Dormant in Free Beta)
Transfer Basis: Dormant in Free Beta. EU-based processing when active.
Data Processed: Host notification dispatches via WhatsApp.
Telegram FZ-LLC
• Operational System Telemetry AlertsLocation: Dubai / Global (Dormant in Free Beta)
Transfer Basis: Dormant by default in Free Beta. All PII strictly redacted before transmission.
Data Processed: Sanitized system crash alerts without personal data or identifiers.
Subprocessor Inquiries
For security questionnaires, data processing agreements, or subprocessor objections:
taakflow Privacy & Security Desk
privacy@taakflow.gr