Updated 16 September 2026
Sub-processors
This English version is provided for convenience. The Romanian version at /ro/informatii-legale/sub-procesatori/ is the binding text.
Last updated: 7 October 2026 · Version 1.1
This page is Annex 2 to the Data Processing Agreement. It lists the providers that Amazing Soft uses to process personal data on behalf of clients (“sub-processors”) and the providers used to operate the amazingsoft.ro website.
The “Applies to” column shows where the provider is involved: Website (visitors to amazingsoft.ro), Delivery (development, hosting, maintenance, website and branding projects) or AI Agents (automation solutions using language models). A provider in the “Delivery” or “AI Agents” category processes a client’s data only if that client’s project uses it; which providers are part of a project is set out in the contract or in the project’s documented instructions.
1. List of sub-processors
| Provider | Legal entity and country | Service / purpose | Data location | Transfer mechanism | Applies to |
|---|---|---|---|---|---|
| Romarg | Romarg SRL, Romania | Web hosting (cPanel, LiteSpeed) for amazingsoft.ro and Amazing Soft products; does not host client websites | Romania (Brașov) | No transfer (EEA). Service contract concluded with Amazing Soft SRL | Website, Delivery |
| Cloudflare | Cloudflare, Inc., USA | DNS for amazingsoft.ro; proxy/CDN and protection (WAF), enabled | Global network, including EU data centres; security logs in the USA/EU (with the proxy active) | EU–US Data Privacy Framework (DPF) (certification confirmed by the provider on 11 September 2026); Standard Contractual Clauses (SCCs) as a fallback, through Cloudflare’s DPA | Website |
| Amazon Web Services | Amazon Web Services EMEA SARL, Luxembourg (Amazon.com, Inc. group, USA) | Sending automated e-mails (Amazon SES): messages from the website’s contact form, to our own address | EU (Frankfurt) | AWS GDPR Data Processing Addendum, with Standard Contractual Clauses; EU–US Data Privacy Framework (Amazon.com, Inc., verified on 7 October 2026) | Website |
| Google Workspace | Google Ireland Limited, Ireland (Google LLC group, USA) | E-mail, Drive, Meet, Calendar: correspondence with clients, project documents, meetings | EU and USA | Google Cloud Data Processing Addendum; EU–US Data Privacy Framework (Google LLC) and Standard Contractual Clauses | Website, Delivery, AI Agents |
| Google Analytics 4 and Tag Manager | Google Ireland Limited, Ireland | Traffic statistics on amazingsoft.ro, loaded only after consent (Consent Mode v2) | EU and USA | Google Ads Data Processing Terms; EU–US Data Privacy Framework | Website |
| Calendly | Calendly LLC, USA | Booking the free 30-minute consultation; loaded only on click; free plan | USA | EU–US Data Privacy Framework (certification confirmed by the provider on 11 September 2026); Standard Contractual Clauses through Calendly’s DPA; Calendly’s DPA (effective 1 June 2026) applies to any account through which personal data is provided, including the free plan (verified on 14 September 2026) | Website |
| Hetzner | Hetzner Online GmbH, Germany | Servers for the tools hosted by Amazing Soft: GitLab (source code, tasks, documentation), n8n (automation workflows), internal AI agents, monitoring; hosting of client applications, only where contracted (currently one client) | Germany (Nuremberg, Falkenstein), audited (TÜV) data centres | No transfer (EEA). Data processing agreement (Article 28 GDPR) concluded with Amazing Soft SRL on 6 September 2026 | Delivery, AI Agents |
| Google Cloud / Firebase | Google Ireland Limited, Ireland | Authentication (Firebase Auth), push notifications (FCM), cloud services for clients’ mobile and web applications | EU and USA (depending on the project region) | Google Cloud Data Processing Addendum (in force); EU–US Data Privacy Framework | Delivery |
| MongoDB Atlas | MongoDB Limited, Ireland | Hosted databases for client applications | EU (eu-central region) | No transfer (EEA). The data processing agreement is incorporated into the MongoDB Cloud terms | Delivery |
| Anthropic | Anthropic Ireland, Limited, Ireland (Anthropic, PBC group, USA) | API for language models (Claude), used in AI agents and automations, on Amazing Soft SRL’s account; model training on the data submitted is disabled. Currently used on Amazing Soft accounts for development and internal operations; for a client’s data, only if the project provides for it | USA | Standard Contractual Clauses (Decision (EU) 2021/914); Anthropic does not state EU–US Data Privacy Framework certification on its pages (verified on 14 September 2026: Anthropic’s privacy policy, effective 10 September 2026, relies only on Standard Contractual Clauses and adequacy decisions for transfers) | AI Agents |
| OpenAI | OpenAI Ireland Ltd., Ireland (EEA customers) / OpenAI, L.L.C., USA | API for language models (GPT), used in AI agents and automations; no training on the data submitted through the API; data sharing with OpenAI for training is disabled at organisation level for all three categories (feedback, evaluation and fine-tuning data, inputs and outputs), verified in the console on 13 September 2026; API call logging is enabled per call, so content is retained at the provider for review by Amazing Soft. Same note as for Anthropic | USA | Standard Contractual Clauses (Decision (EU) 2021/914) through OpenAI’s DPA, with OpenAI Ireland Ltd. as the contracting entity; OpenAI is not certified under the EU–US Data Privacy Framework (verified on 11 September 2026) | AI Agents |
| Apple App Store Connect | Apple Distribution International Ltd., Ireland | Publishing and testing (TestFlight) clients’ iOS applications | EU and USA | Apple Developer Program terms; Standard Contractual Clauses | Delivery |
| Google Play Console | Google Ireland Limited, Ireland | Publishing and testing clients’ Android applications | EU and USA | Google Play Developer Distribution terms; EU–US Data Privacy Framework | Delivery |
Collaborators who have access to client data work under a confidentiality agreement and under Amazing Soft’s instructions.
About transfers to the USA. The EU–US Data Privacy Framework status of each provider in the table was verified on 11 September 2026 on the providers’ pages and is re-verified annually on dataprivacyframework.gov/list. For all US providers, the Commission’s Standard Contractual Clauses (Decision (EU) 2021/914) are also in place in the provider’s data processing agreement, as a fallback mechanism; if adequacy decision (EU) 2023/1795 were invalidated, transfers would continue on the basis of these clauses, without amending the Agreement. Google LLC (Workspace, Analytics, Firebase, Play) is listed as DPF-certified, confirmed by the provider on the same date. Amazon.com, Inc. (the group Amazon Web Services belongs to) is listed as DPF-certified, verified on the official list on 7 October 2026.
2. Providers that are not sub-processors
- Tools hosted by us (GitLab at gitlab.amazingsoft.ro, n8n, Umami, Uptime Kuma, PowerSync): they run on the Hetzner servers listed above; the software vendor does not receive any data.
- Software installed on the website’s server (LiteSpeed Cache, Elementor Pro, Rank Math, UpdraftPlus, Complianz): data does not leave the server through them; Rank Math Analytics is turned off. Exception: the website’s backups, made with UpdraftPlus, go to Google Drive (Google Workspace) and Hetzner, both listed in the table above.
- Wordfence (Defiant Inc., USA): firewall and scanning for WordPress; the IP addresses of blocked attacks are not sent to the Wordfence network.
- WhatsApp (WhatsApp Ireland Limited / Meta): the button on the website is a plain link (wa.me) that opens the visitor’s app; Meta does not process data on our behalf. If an AI agent project uses the WhatsApp Business Platform, Meta becomes a sub-processor for that project and is added to the table with prior notice.
- Sentry (Functional Software, Inc., USA; EU option): error reporting used only for one of Amazing Soft’s own products, not for client data.
- Oblio (Oblio Software SRL, Romania): invoicing. For invoicing data, Amazing Soft is the controller; Oblio appears in the Privacy Policy, not here.
- Providers chosen by the client (own hosting, own CRM, own API keys for AI models, payment processors): they are the client’s processors (Article 9.6 of the Agreement).
The website’s previous policy (2020) mentioned tools we do not use: Slack, Notion, Jira, Backblaze, Make, Dropbox, Uptime Robot, LiveChat, Google AdSense, Facebook Audience Network, WordPress.com. This page replaces them.
3. How to receive notifications about changes
Under Article 9.2 of the Agreement, Amazing Soft gives notice of the addition or replacement of a sub-processor at least 30 days in advance, by updating this page and by e-mail.
To receive the e-mail, send a message to office@amazingsoft.ro with the subject “Sub-processor notifications”, stating your company and the address at which you want to receive the notifications. Clients with a contract in progress receive the notification automatically at the contact address in the contract. You may object within 15 days of the notification, under Article 9.3 of the Agreement.
4. Change history
| Date | Version | Change |
|---|---|---|
| 7 October 2026 | 1.1 | Added Amazon Web Services (Amazon SES, Frankfurt), for sending the messages from the website’s contact form. |
| 16 September 2026 | 1.0 | Initial list, published together with the new website and the Data Processing Agreement v1.0. |
Questions about sub-processors: gdpr@amazingsoft.ro.