Last updated: 20 July 2026
Subprocessor list
Kadova uses the sub-processors below to deliver the platform. This list forms part of the DPA. We notify customers at least 30 days before material changes.
1. Overview
The table below lists each sub-processor’s purpose, data categories, processing location and link to the provider DPA or privacy terms. Internal archive and acceptance status: see docs/legal/provider-dpa-register.md (not public).
2. Changes
Sub-processor changes are published on this page with an updated date. Customers with active accounts receive email or in-app notice for material changes.
3. Contact
Questions or objections to sub-processors? privacy@kadova.nl
| Sub-processor | Purpose | Data | Location | DPA / privacy |
|---|---|---|---|---|
| Render Services, Inc. | Hosting of API, web, worker, PostgreSQL and Redis (Frankfurt, EU) | Account data, gift card and transaction data, logs, uploads, configuration, sessions | EU | Provider documentAccepted in provider dashboard DPA downloaded via Render Document Center; also applies via ToS. |
| Cloudflare, Inc. (R2) | Object storage for documents, exports and gift card assets (EU jurisdiction) | Files, PDFs, exports, gift card designs, uploaded logos | EU | Provider documentAccepted in provider dashboard Customer DPA v6.4 (2026-04-03) archived; verify R2 EU jurisdiction. |
| Cloudflare, Inc. (DNS) | DNS management for kadova.nl and related domains | DNS query metadata, IP addresses (limited) | EU/US | Provider documentAccepted in provider dashboard |
| Brevo (Sendinblue SAS) | Transactional email (SMTP) and webhook status | Email addresses, names, gift card/order content in templates, delivery logs | EU | Provider documentAvailable via provider terms DPA = Appendix 3 in ToS; reference PDF archived 2026-07-20. |
| Stripe Payments Europe, Ltd. | Platform subscriptions and shop payments (card, iDEAL, etc.) | Payment metadata, billing details; Kadova does not store full card numbers | EU/US | Provider documentAccepted in provider dashboard Stripe DPA PDF (2025-11-18) archived. |
| Mollie B.V. | Alternative payment provider for shop and platform payments | Payment metadata, billing details, webhook events | EU | Provider documentAvailable via provider terms DPA via User Agreement; reference PDF archived 2026-07-20. |
| Functional Software, Inc. (Sentry) | Error monitoring and performance (optional per environment) | Anonymised/pseudonymised logs, stack traces, user-id hashes | US | Provider documentAccepted in provider dashboard DocuSign DPA accepted in Sentry Legal & Compliance. |
| Expo (650 Industries, Inc.) / EAS | Mobile builds, OTA updates and push infrastructure | Device tokens, build artefacts, crash logs (if enabled) | US | Provider documentTo be accepted before production go-live Relevant for Kadova Winkel app only. |
| Apple Inc. | Apple Push Notification service (APNs) and Apple Wallet passes | Device tokens, pass identifiers, gift card metadata in wallet passes | US | Provider documentAvailable via provider terms Apple is an independent processor; terms via Apple Developer Program. |
| Google LLC | Firebase Cloud Messaging (push) and Google Wallet passes | Device tokens, pass identifiers, gift card metadata | US | Provider documentAvailable via provider terms Mobile push (FCM) and Google Wallet passes only — not website analytics. See separate entry: google_analytics. |
| Google LLC (Google Analytics 4) | Website analytics on marketing pages (traffic, channels, conversion funnel) — only after cookie consent | Online identifiers (e.g. cookie/client id), IP (truncated where possible), page URLs, events, device/browser data; no account passwords | EU/US | Provider documentAccepted in provider dashboard Separate from FCM/Wallet. Consent Mode v2: analytics_storage denied until consent; ads stay denied. Ads Data Processing Terms accepted 2026-07-22 (Account settings). See docs/analytics.md. |
| Microsoft Ireland Operations Ltd. | Business email and support mailboxes (@kadova.nl) | Email correspondence with customers and support requests | EU | Provider documentAccepted in provider dashboard Microsoft DPA May 2026 downloaded; applies via Customer Agreement. |