Effective from 1 July 2026
This is the complete and current list of sub-processors under Art. 28(4) GDPR - that is, the providers who, in the course of providing the creatorbox platform, receive the personal data of a Creator's Buyers. The list is deliberately short: internal tools (email, chat, analytics without identifying individuals) do not process Buyers' data and are not listed here. We will inform you of any intended change at least 30 days in advance; you have the right, for serious data-protection reasons, to raise an objection - see the DPA, Art. 4, for details.
Hetzner Online GmbH (Germany) - primary application and database hosting. Servers in the EU/EEA. DPA: hetzner.com/legal/order-processing
Cloudflare R2 (Cloudflare, Inc., USA) - storage of files uploaded by Creators (product images, downloadable files, course files). EU region. DPA + SCC: cloudflare.com/cloudflare-customer-dpa
Cloudflare, Inc. (USA, edge nodes across the EU) - CDN, DNS, DDoS protection. Personal data passes through the edge network only in transit (TLS) and is not stored there. DPA + SCC: cloudflare.com/cloudflare-customer-dpa
Stripe Payments Europe Limited (Ireland) - processing of Buyer payments as part of direct charges to the Creator's Stripe account, and processing of payments for creatorbox subscriptions. Stripe acts as an independent controller of payment data. DPA + SCC: stripe.com/legal/dpa
Mailgun Technologies, Inc. (USA, EU region - Frankfurt) - sending transactional emails (order confirmations, invoices, delivery of digital content, marketing at the Creator's instruction). We operate in the EU region. DPA + SCC: mailgun.com/dpa
Creatorbox does not, by default, use generative AI to process the data of Creators or their Buyers. If an optional AI feature is added to the Service (e.g. suggested product descriptions, generated cover images, review summaries), the specific provider (e.g. OpenAI Ireland Limited, Anthropic PBC) will be named on this page with 30 days' advance notice. Commitment: neither the Creator's nor its Buyers' data is used to train the provider's or the Operator's AI models. Details in the DPA, Art. 9.
Primary processing (Hetzner, Stripe Europe) takes place within the EU/EEA. For Cloudflare and Mailgun (US entities, EU regions), the European Commission's Standard Contractual Clauses (SCCs) under Decision 2021/914 are applied, or certification under the EU-US Data Privacy Framework. A copy of the SCCs is available on request: hello@creatorbox.cz.
Some tools we use are not processors of Buyers' personal data within the meaning of Art. 28 GDPR and do not appear on this list: • our team's internal email and calendar (used for our own internal communication, not for sending messages to Buyers), • our internal team chat, • visit analytics (Google Analytics 4, via Google Tag Manager) - this runs exclusively with user consent (Consent Mode v2), and the Operator operates it as an independent controller for its own purposes; it is not a processor of Buyers' personal data within the meaning of Art. 28 GDPR (see the Privacy Policy, Art. 5 and 6, and the Cookie Policy, for details and the provider's name), • our own backup infrastructure. We deliberately limit this list to providers to whom we actually transfer Buyers' personal data as our processor under Art. 28(4) GDPR.
We will announce an intended addition or replacement of a sub-processor at least 30 days in advance: • by email to the primary contact address on the account, • by an in-app notice, • by updating this page with the effective date. The Creator may, for serious data-protection reasons, raise an objection within 14 days of the notice. The procedure for handling the objection and the option to terminate the agreement without penalty are set out in the DPA, Art. 4. Contact: hello@creatorbox.cz.