Sub-processors
Last updated: 21 September 2026
Overview
Under Section 5 of the DPA, the Customer gives Cloudpepper general written authorisation to engage the Sub-processors listed below. Cloudpepper imposes on each Sub-processor, in substance, the same data protection obligations as the DPA imposes on Cloudpepper for the processing delegated to it, and remains liable to the Customer for their performance as set out in the DPA.
Current sub-processors
The following Sub-processors are authorised as at the “Last updated” date shown above. Capitalised terms have the meaning given to them in the DPA.
| Sub-processor | Purpose of processing | Location | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Cloud infrastructure and data hosting for the Cloudpepper management platform. | EEA (Belgium / Ireland regions) | N/A (EEA) |
| Google Cloud EMEA Limited | Cloud infrastructure and data hosting for the Cloudpepper management platform. | EEA (Belgium region) | N/A (EEA) |
| OVH SAS (OVHcloud) | Backup storage and Kubernetes-based workloads relating to Customer environments. | EEA (France) | N/A (EEA) |
| UpCloud Ltd | Hosting infrastructure for the Dedicated Performance deployment tier of the managed Odoo Service. | EEA (Customer-selected region; non-EEA available on request) | SCCs (where applicable) |
| The Constant Company, LLC (Vultr) | Hosting infrastructure for the High Performance deployment tier of the managed Odoo Service. | EEA (Customer-selected region; non-EEA available on request) | SCCs |
| Cloudflare, Inc. | CDN, DDoS protection and edge security in front of the Services. | Global edge; primary processing EU/US | SCCs |
| Crisp IM SAS | Customer support chat, ticketing and support communications, including information the Customer submits for troubleshooting. | EEA | N/A (EEA) |
| Functional Software, Inc. (Sentry) | Application error monitoring for the Cloudpepper platform. | EEA (Germany data region) | N/A (EEA); SCCs under Sentry’s DPA for any support access from outside the EEA |
| Google Ireland Limited (Google Workspace) | Company e-mail, including support correspondence. | EEA / US | SCCs (Google Workspace Data Processing Addendum) |
Customer-chosen infrastructure
Where a customer deploys the Services on infrastructure it procures directly from a provider of its choice (any data centre, any provider, any country), that provider is engaged by the customer, not by Cloudpepper, and is not a Sub-processor. The customer is responsible for the data protection arrangements with that provider, including a data processing agreement and any transfer mechanism required for transfers outside the EEA. See Section 6 of the DPA.
Providers that are not sub-processors
Providers that do not process Customer Data are not Sub-processors: for example payment processing (Stripe), accounting and ERP (Odoo SA) and marketing e-mail (Klaviyo). They process data that Cloudpepper itself controls. See Section 5.2 of the DPA and our Privacy Policy.
Notice of changes
Before Cloudpepper adds or replaces a Sub-processor, it e-mails the contact address on the Customer’s account and updates this page. The notice identifies the provider, its role, its locations and the transfer mechanism, and allows at least fourteen (14) days before the new Sub-processor processes Customer Data (DPA, Section 5.4). Keep the contact address on your account current.
Right to object
Under Section 5.5 of the DPA, the Customer may object within the notice period on reasonable grounds relating to data protection. The parties discuss the objection in good faith. Cloudpepper is not obliged to provide an alternative to the notified change. If no solution is found, either party may terminate the affected Services by written notice before the new Sub-processor processes the Customer’s data, without penalty.
Contact
Cloudpepper BVWitte Patersstraat 4, 1040 Brussels, Belgium
Email: privacy@cloudpepper.io