Last updated: 20 July 2026

Subprocessor list

Kadova uses the sub-processors below to deliver the platform. This list forms part of the DPA. We notify customers at least 30 days before material changes.

1. Overview

The table below lists each sub-processor’s purpose, data categories, processing location and link to the provider DPA or privacy terms. Internal archive and acceptance status: see docs/legal/provider-dpa-register.md (not public).

2. Changes

Sub-processor changes are published on this page with an updated date. Customers with active accounts receive email or in-app notice for material changes.

3. Contact

Questions or objections to sub-processors? privacy@kadova.nl

Sub-processorPurposeDataLocationDPA / privacy
Render Services, Inc.Hosting of API, web, worker, PostgreSQL and Redis (Frankfurt, EU)Account data, gift card and transaction data, logs, uploads, configuration, sessionsEUProvider documentAccepted in provider dashboard

DPA downloaded via Render Document Center; also applies via ToS.

Cloudflare, Inc. (R2)Object storage for documents, exports and gift card assets (EU jurisdiction)Files, PDFs, exports, gift card designs, uploaded logosEUProvider documentAccepted in provider dashboard

Customer DPA v6.4 (2026-04-03) archived; verify R2 EU jurisdiction.

Cloudflare, Inc. (DNS)DNS management for kadova.nl and related domainsDNS query metadata, IP addresses (limited)EU/USProvider documentAccepted in provider dashboard
Brevo (Sendinblue SAS)Transactional email (SMTP) and webhook statusEmail addresses, names, gift card/order content in templates, delivery logsEUProvider documentAvailable via provider terms

DPA = Appendix 3 in ToS; reference PDF archived 2026-07-20.

Stripe Payments Europe, Ltd.Platform subscriptions and shop payments (card, iDEAL, etc.)Payment metadata, billing details; Kadova does not store full card numbersEU/USProvider documentAccepted in provider dashboard

Stripe DPA PDF (2025-11-18) archived.

Mollie B.V.Alternative payment provider for shop and platform paymentsPayment metadata, billing details, webhook eventsEUProvider documentAvailable via provider terms

DPA via User Agreement; reference PDF archived 2026-07-20.

Functional Software, Inc. (Sentry)Error monitoring and performance (optional per environment)Anonymised/pseudonymised logs, stack traces, user-id hashesUSProvider documentAccepted in provider dashboard

DocuSign DPA accepted in Sentry Legal & Compliance.

Expo (650 Industries, Inc.) / EASMobile builds, OTA updates and push infrastructureDevice tokens, build artefacts, crash logs (if enabled)USProvider documentTo be accepted before production go-live

Relevant for Kadova Winkel app only.

Apple Inc.Apple Push Notification service (APNs) and Apple Wallet passesDevice tokens, pass identifiers, gift card metadata in wallet passesUSProvider documentAvailable via provider terms

Apple is an independent processor; terms via Apple Developer Program.

Google LLCFirebase Cloud Messaging (push) and Google Wallet passesDevice tokens, pass identifiers, gift card metadataUSProvider documentAvailable via provider terms

Mobile push (FCM) and Google Wallet passes only — not website analytics. See separate entry: google_analytics.

Google LLC (Google Analytics 4)Website analytics on marketing pages (traffic, channels, conversion funnel) — only after cookie consentOnline identifiers (e.g. cookie/client id), IP (truncated where possible), page URLs, events, device/browser data; no account passwordsEU/USProvider documentAccepted in provider dashboard

Separate from FCM/Wallet. Consent Mode v2: analytics_storage denied until consent; ads stay denied. Ads Data Processing Terms accepted 2026-07-22 (Account settings). See docs/analytics.md.

Microsoft Ireland Operations Ltd.Business email and support mailboxes (@kadova.nl)Email correspondence with customers and support requestsEUProvider documentAccepted in provider dashboard

Microsoft DPA May 2026 downloaded; applies via Customer Agreement.