Subprocessors
Last updated: 8 July 2026
CarsEXP uses a small number of vetted subprocessors to provide the service. Each is bound by data-protection terms no less protective than our DPA. We give advance notice of changes so controllers can object on reasonable grounds.
| Subprocessor | Purpose | Location | Status |
|---|---|---|---|
| Hetzner Online GmbH | Cloud hosting, database and file storage (infrastructure) | Germany (EU) | Active |
| Paddle.com Market Ltd | Payment processing and subscription billing (Merchant of Record) | United Kingdom | Active |
| SK ID Solutions AS | Electronic identity sign-in (Smart-ID / Mobiil-ID) | Estonia (EU) | Planned |
| MailerSend | Transactional e-mail (account and workshop notifications) | EU | Planned |
| Messente Communications OÜ | SMS notifications and one-time codes | Estonia (EU) | Planned |
| Google Ireland Limited (Firebase Cloud Messaging) | Push notification delivery to the app (device push token and notification text) | EU / USA (SCCs) | Planned |
| Anthropic | AI assistant (only data the workshop explicitly submits) | USA (SCCs) | Planned |
Where a subprocessor is located outside the EEA, transfers rely on an adequacy decision or the EU Standard Contractual Clauses with supplementary measures.
File media and databases are stored on EU infrastructure (Hetzner). Questions: privacy@carsexp.com.