Transparency · Art. 28 GDPR
Sub-processors and recipients
Version date: 16 September 2026
ReviewChef engages the following sub-processors to provide the service. This list forms part of our Data Processing Agreement. Customers are notified by email at least 30 days before any addition or replacement. Last updated: 16 September 2026.
Sub-processors under the Data Processing Agreement
| Sub-processor | Purpose | Location of processing | Transfer safeguard |
|---|---|---|---|
| Hetzner Online GmbH, Germany | application hosting, database, object storage | Germany | none required (EU) |
| Scaleway SAS, France | transactional email delivery | France | none required (EU) |
| TOPefekt s.r.o. (BulkGate), Czech Republic | SMS notifications to venue staff | Czech Republic | none required (EU) |
| Amazon Web Services EMEA SARL, Luxembourg | AI-assisted summarisation of feedback via Amazon Bedrock, region eu-central-1 (Frankfurt); no data used for model training | Germany | none required (EU); AWS Data Processing Addendum |
| Functional Software, Inc. (Sentry), USA — EU data region | error reports from the application: the address of the failing request, the error message and the program location; never cookies, IP addresses or request contents | Germany (EU data region) | EU–US Data Privacy Framework; Sentry Data Processing Addendum with EU Standard Contractual Clauses |
Other recipients (not sub-processors under the DPA)
| Recipient | Role | Purpose | Location | Transfer safeguard |
|---|---|---|---|---|
| Stripe Payments Europe Ltd, Ireland | Independent controller | payment processing (customer billing data only, no guest data) | Ireland; limited transfers to Stripe Inc., USA | EU–US Data Privacy Framework / Standard Contractual Clauses |
| Google Ireland Ltd | Independent controller | account sign-in (Google Sign-In), venue address lookup (Places Autocomplete) and the intro video (YouTube); customer data only, no guest data | Ireland; possible transfers to Google LLC, USA | EU–US Data Privacy Framework / Standard Contractual Clauses |
| Plausible Insights OÜ, Estonia | Processor (ReviewChef website data) | cookieless, aggregated web analytics; no personal data of guests | Germany (EU hosting) | none required (EU) |
| Cloudprinter.com B.V., Netherlands | Independent controller | produces physical QR cards and receives the print file (venue name, table numbers, QR codes) as well as the recipient name and delivery address | Netherlands | none required (EU) |