Sub-processors
Last updated: 24 October 2026
Overview
Under Section 5 of the DPA, the Customer gives Cloudpepper general written authorisation to engage the Sub-processors listed below. Cloudpepper imposes on each Sub-processor, in substance, the same data protection obligations as the DPA imposes on Cloudpepper for the processing delegated to it, and remains liable to the Customer for their performance as set out in the DPA.
Current sub-processors
The following Sub-processors are authorised as at the “Last updated” date shown above. Capitalised terms have the meaning given to them in the DPA.
| Sub-processor and privacy contact | Purpose of processing | Location | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services EMEA SARL 38 Avenue John F. Kennedy, L-1855 Luxembourg aws-EU-privacy@amazon.com |
Cloud infrastructure and data hosting for the Cloudpepper management platform. | EEA (Belgium / Ireland regions) | N/A (EEA) |
| Google Cloud EMEA Limited 70 Sir John Rogerson’s Quay, Dublin 2, Ireland Data protection contact form |
Cloud infrastructure and data hosting for the Cloudpepper management platform. | EEA (Belgium region) | N/A (EEA) |
| OVH SAS (OVHcloud) 2 rue Kellermann, 59100 Roubaix, France dpo@ovh.com |
Backup storage and Kubernetes-based workloads relating to Customer environments. | EEA (France) | N/A (EEA) |
| UpCloud Ltd Aleksanterinkatu 15 B, 00100 Helsinki, Finland Privacy notice |
Hosting infrastructure for the Dedicated Performance deployment tier of the managed Odoo Service. | EEA (Customer-selected region; non-EEA available on request) | SCCs (where applicable) |
| The Constant Company, LLC (Vultr) 319 Clematis Street, Suite 900, West Palm Beach, FL 33401, USA Privacy policy |
Hosting infrastructure for the High Performance deployment tier of the managed Odoo Service. | EEA (Customer-selected region; non-EEA available on request) | SCCs |
| Cloudflare, Inc. 101 Townsend Street, San Francisco, CA 94107, USA dpo@cloudflare.com |
CDN, DDoS protection and edge security in front of the Services. | Global edge; primary processing EU/US | SCCs |
| Crisp IM SAS 2 Boulevard de Launay, 44100 Nantes, France dpo@crisp.chat |
Customer support chat, ticketing and support communications, including information the Customer submits for troubleshooting. | EEA | N/A (EEA) |
| Functional Software, Inc. (Sentry) 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA compliance@sentry.io |
Application error monitoring for the Cloudpepper platform. | EEA (Germany data region) | N/A (EEA); SCCs under Sentry’s DPA for any support access from outside the EEA |
| Google Ireland Limited (Google Workspace) Gordon House, Barrow Street, Dublin 4, Ireland Data protection contact form |
Company e-mail, including support correspondence. | EEA / US | SCCs (Google Workspace Data Processing Addendum) |
Customer-chosen infrastructure
Where a customer deploys the Services on infrastructure it procures directly from a provider of its choice (any data centre, any provider, any country), that provider is engaged by the customer, not by Cloudpepper, and is not a Sub-processor. The customer is responsible for the data protection arrangements with that provider, including a data processing agreement and any transfer mechanism required for transfers outside the EEA. See Section 6 of the DPA.
Providers that are not sub-processors
Providers that do not process Customer Data are not Sub-processors: for example payment processing (Stripe), accounting and ERP (Odoo SA) and marketing e-mail (Klaviyo). They process data that Cloudpepper itself controls. See Section 5.2 of the DPA and our Privacy Policy.
Notice of changes
Before Cloudpepper adds or replaces a Sub-processor, it notifies the Customer by e-mail to the contact address on the Customer’s account or by a notice in My Cloudpepper, and updates this page. The notice identifies the provider, its role, its locations and the transfer mechanism, and allows at least fourteen (14) days before the new Sub-processor processes Customer Data (DPA, Sections 5.4 and 15.7). Keep the contact address on your account current.
Right to object
Under Section 5.5 of the DPA, the Customer may object within the notice period on reasonable grounds relating to data protection. The parties discuss the objection in good faith. Cloudpepper is not obliged to provide an alternative to the notified change. If no solution is found, either party may terminate the affected Services by written notice before the new Sub-processor processes the Customer’s data, without penalty.
Contact
Cloudpepper BVWitte Patersstraat 4, 1040 Brussels, Belgium
Email: privacy@cloudpepper.io