Separate overview of processors commissioned by OUHUD, optional providers, payment services and recipients activated exclusively by the customer.
This is a convenience translation. The legally binding version of this document is the German one.
This page is not yet ready for publication.
The following mandatory details or checks are still open: Production hosting provider and contracting entity · E-mail delivery provider including data processing agreement · Technical release lock between provider configuration and this list. The affected legal page stays excluded from search engines until it is complete.
Confirmed in production
Currently 0 external processors
Activation principle
Provider only after contract, location and transfer review
Change notification
At least 30 days in advance to the administrator address
1. Status and legal classification
Nicht jeder externe Dienst ist ein Unterauftragsverarbeiter. Die Liste trennt deshalb vier Fälle: „im Einsatz“ kennzeichnet einen von Ouhud GmbHbeauftragten und im Rahmen der AVV genehmigten Auftragsverarbeiter. „Geplant“ und „optional“ sind noch nicht genehmigte Kandidaten. „Nur bei Kundenaktivierung“ bezeichnet Empfänger, die der Kunde selbst verbindet oder auswählt. „Noch nicht ausgewählt“ markiert eine echte offene Betriebsangabe.
2. Von OUHUD eingesetzte Unterauftragsverarbeiter
No external provider confirmed in production yet
The current general authorisation under the data processing agreement therefore does not yet cover any external sub-processor. Before production operation, at least the actual hosting provider must be entered here in full.
3. Planned and optional providers
The following providers are technical candidates or optional features. They are not part of the current sub-processing authorisation and must not receive processed data before the respective reviews have been completed and customers have been properly informed.
In use
Hetzner Online GmbH
Intended processor for hosting
Purpose
Planned operation of the application and self-managed database, cache, object storage, malware scanning and parser components.
Data categories
Depending on use, all account, organisation, project, website, document, content, integration, log and contract data.
Location
Data centre Helsinki (Tuusula), Finland. Location and EU-only processing are laid down in the data processing agreement of 4 September 2026 (§ 3(1), Annex 3).
Transfer / Grundlage
EU/EEA, evidenced. A move to another data centre region is recorded here in advance; regions outside the EU are not approved.
Optional · not activated
OpenAI Ireland Limited
Potential processor for enabled AI features
Purpose
Optional embeddings and knowledge search, content and quality features as well as OpenAI web search for visibility measurements.
Data categories
Selected knowledge sections and website content, prompts, questions, confirmed facts, drafts, outputs as well as pseudonymous organisation and usage metadata.
Location
The documented standard configuration is not released as EU-only or zero data retention; global processing including the USA must be taken into account before activation.
Transfer / Grundlage
The DPA, the specific data region, retention, current sub-processors and a suitable transfer safeguard must be confirmed before activation.
Optional · not activated
Anthropic, PBC
Potential processor for enabled AI features
Purpose
Optional creation of briefs and drafts as well as automated quality checking.
According to the provider's standard information, multi-regional processing and storage in the USA unless otherwise agreed.
Transfer / Grundlage
The DPA, standard contractual clauses, retention, sub-processors and supplementary protective measures must be reviewed before activation.
Optional · not activated
Perplexity AI, Inc.
Potential processor for AI Visibility
Purpose
Optional querying of the Sonar API for sample-based measurement of answers and sources.
Data categories
Questions or prompts defined by the customer; answer excerpts, source URLs and measured values are returned and stored at OUHUD.
Location
US provider; the publicly available API documentation does not specify all actual processing locations for every constellation.
Transfer / Grundlage
The DPA, retention, processing locations and a suitable transfer instrument must be reviewed bindingly before activation.
Not yet selected
E-mail delivery provider
Future processor; not yet selected
Purpose
Transactional e-mails such as invitations, e-mail confirmation, password reset and system notifications.
Data categories
Recipient and sender address, subject, text and HTML content, technical delivery information and time-limited action links.
Location
Not yet determined.
Transfer / Grundlage
Provider, contracting entity, data processing agreement, sub-processors, locations and transfer basis are published before activation.
4. Payment service with mixed roles
Payment services process data, depending on the individual service, partly on behalf and partly under their own statutory responsibility. They are therefore not presented across the board as sub-processors for customer content.
Optional · not activated
Stripe Payments Europe, Limited
Payment service provider with a mixed role, depending on the service, as processor and independent controller
Purpose
Hosted checkout, subscription management, customer portal, invoicing and payment processing as well as fraud prevention.
Data categories
Business e-mail, organisation and plan reference, customer and subscription ID; Stripe additionally collects payment, invoicing, address and fraud prevention data.
Location
Ireland; depending on the service, global processing including the USA and further Stripe entities or sub-processors.
Transfer / Grundlage
Stripe DPA and Data Transfer Addendum; the specific role depends on the payment service used. Not activated in the documented development status.
5. Integrations and recipients activated by the customer
Diese Dienste erhalten Daten nur, wenn der Kunde eine Verbindung herstellt oder eine Übermittlung auslöst. Sie sind dadurch nicht automatisch vonOuhud GmbH beauftragte Unterauftragsverarbeiter. Der Kunde entscheidet über Zweck, Auswahl und Konfiguration und muss die Zulässigkeit seiner Übermittlung prüfen.
Only on customer activation
Google Search Console
Integration service connected by the customer; role depends on the service
Purpose
Retrieval of Search Console performance data for a property released by the customer.
Data categories
OAuth token, property or site URL, period and dimensions; search queries, clicks, impressions and positions flow back.
Location
Google LLC or, depending on account and service, Google Ireland Limited; global processing may take place.
Transfer / Grundlage
The connection is established only on the customer's instruction. The contracting entity, API terms and transfer rules of the customer account are decisive.
Only on customer activation
Microsoft Bing Webmaster Tools
Integration service connected by the customer
Purpose
Retrieval of search performance data for a website connected by the customer.
Data categories
API access, site URL and query parameters; search queries, clicks, impressions and positions flow back.
Location
For customers in the EU and Switzerland regularly Microsoft Ireland Operations Limited; further global processing is possible.
Transfer / Grundlage
Activation only on the customer's instruction; the Bing-specific terms and data protection roles are decisive for the specific connection.
Only on customer activation
Google Analytics 4
Analytics service connected by the customer; role depends on the service
Purpose
Retrieval of the analytics report and property data selected by the customer.
Data categories
OAuth token, account, property and period references; in particular aggregated usage, event, page and acquisition metrics flow back.
Location
Google LLC or, depending on account and service, Google Ireland Limited; global processing may take place.
Transfer / Grundlage
The connection is established only on the customer's instruction. The contracting entity, account settings, Google terms and transfer rules of the customer account are decisive.
Only on customer activation
IndexNow and participating search engines
Independent recipients determined by the customer
Purpose
Optional notification of new or changed public URLs to the IndexNow network.
Data categories
Host, verification key, key URL and complete page URLs to be reported. Participants may exchange the reported URLs among themselves.
Location
Several providers and countries; the current participant list of the IndexNow protocol is decisive.
Transfer / Grundlage
Only after customer action. Personal or confidential values must not appear in URL paths or query parameters.
Only on customer activation
Customer's own WordPress
Target system determined by the customer
Purpose
Checking the connection and publishing approved content.
Data categories
Instance URL, encrypted stored credentials, title, HTML content, excerpt, status, categories, tags and slug; post ID and URL are returned.
Location
Determined by the customer and its hosting provider.
Transfer / Grundlage
The transfer takes place exclusively on the customer's instruction. The customer is responsible for lawfulness and the contractual relationship with the target system.
Only on customer activation
Customer's own webhooks
Recipient determined by the customer
Purpose
Connection test and transmission of approved, signed events.
Data categories
Target URL, technical headers and the payload determined by the customer for the respective event.
Location
Determined by the customer and the operator of the target endpoint.
Transfer / Grundlage
The customer configures the recipient and is responsible for the legal basis, security and third-country transfer.
6. Selbst betriebene technische Komponenten
According to the current architecture, PostgreSQL, Redis, MinIO, ClamAV and the isolated document parser are self-operated software components within the chosen hosting environment. They are not independent external recipients. Their infrastructure processing is attributed to the actual hosting provider.
A mere configuration option does not yet make a data recipient. That is why Sentry, Webflow, Shopify, AWS, Backblaze, Google Vertex or other pure roadmap and placeholder services are not listed here as active. Locally embedded web fonts are provided at build time and do not trigger any browser request to Google Fonts.
7. International transfers
From an EU and EEA perspective, processed data is transferred only on the basis of an adequacy decision under Art. 45 GDPR or appropriate safeguards under Art. 46 GDPR. Certification under a data protection framework applies only if the specific recipient and the data type concerned are currently covered. Otherwise, in particular standard contractual clauses 2021/914, a transfer impact assessment and necessary supplementary measures are required.
Art. 16 to 18 FADP apply to disclosures from Switzerland. Recognised standard data protection clauses are used with the necessary Swiss adaptations. A technical option or a provider's marketing statement is not sufficient as evidence of transfer.
8. New providers, notification and objection
New or replaced sub-processors are actively notified at least 30 days before the start to the administrator address stored in the customer account. The notification contains the provider, purpose, data categories, processing locations and transfer basis. A mere change to this website does not replace the active notification.
Kunden können innerhalb der Frist aus nachvollziehbaren datenschutzrechtlichen Gründen widersprechen. Ouhud GmbH prüft eine zumutbare Alternative. Ist sie nicht möglich, wird die betroffene Funktion nicht über den beanstandeten Anbieter bereitgestellt; Rechte zur Kündigung des betroffenen Leistungsteils richten sich nach der data processing agreement.
9. Contact and current version
Fragen zu Empfängern, Rollen oder Transfergarantien richten Sie an info@ouhud.com. Decisive for the authorisation under the data processing agreement is the “in use” list documented at the time the contract was concluded, plus subsequent changes properly notified.
This text is a draft and does not replace legal advice. Before publication it should be reviewed by a lawyer specialising in IT and data protection law — in particular the liability rules and the statements on data processing.
