Core providers
- Hetzner Online GmbH, Germany - hosting of the application, databases, files, and backups. Dyukyan production data is stored at a selected Hetzner location in Germany.
- Brevo - Sendinblue SAS, Brevo GmbH, or Sendinblue GmbH, according to the entity identified on the Provider's account invoice - delivery of service and transactional email. It may process the recipient's name and email, subject, content, delivery metadata, and attachments where included in the relevant message. Brevo states that its data is stored within the European Union using infrastructure in France, Germany, and Belgium.
Optional-feature providers
The following providers receive data only when the customer uses the relevant feature or operation:
- OpenAI Ireland Limited - AI assistant, AI-assisted content creation, and document processing. Only prompts, selected data, and files needed for the requested result are submitted through the AI-enabled feature. Processing may involve approved subprocessors and international transfers protected by applicable contractual safeguards.
- Google Cloud EMEA Limited and applicable Google group companies - translation, geocoding, and reCAPTCHA. Depending on the feature, processing may include text submitted for translation, an address submitted for geocoding, or technical anti-abuse data. Processing may be global subject to applicable contractual safeguards.
- Stripe Payments Europe, Limited - adding payment cards and processing subscription payments. Stripe may act as both processor and independent controller for certain purposes, including fraud prevention and legal compliance. Dyukyan does not store the full card number or security code.
Customer-directed integrations
Where the customer activates or configures its own SMTP provider, Google Analytics, Meta Pixel, myPOS, BORICA, electronic shelf labels, or another external integration, data is sent to that provider on the customer's instructions. Those providers may act as the customer's processors or as independent controllers under their own terms. The customer is responsible for identifying them in its own privacy information and establishing the required legal basis.
Processing locations and changes
Core hosting is located in Germany. Where a provider processes data outside the European Economic Area, we use an applicable GDPR Chapter V mechanism, such as an adequacy decision or the European Commission's Standard Contractual Clauses, and supplementary safeguards where required.
Contract customers are notified of a planned addition or replacement of a subprocessor at least 15 days in advance under the Data Processing Agreement.
Contact
For questions about providers and personal-data processing, email contact@dyukyan.bg.
