List of Sub-processors

Note on the authoritative language: This English text is a non-binding convenience translation. The legally binding and authoritative version is the German original (available at regfish.de/legal/subprocessors). In the event of any discrepancy between this translation and the German version, or in the event of a dispute, the German version shall prevail. (1) This overview names the sub-processors that regfish GmbH (regfish GmbH, Bleichstraße 8a, 35390 Gießen) engages in the context of processing on behalf of the controller for its business customers. It supplements the data processing agreement (available at regfish.de/legal/dpa) and constitutes Annex 3 thereto. Authoritative for the contractual relationship is the version referenced in the respective data processing agreement. (2) regfish operates the hosting and mail infrastructure itself; in this respect no external sub-processor is engaged. regfish will inform the affected controllers in advance, in text form, of material changes to this list – in particular the addition of a new sub-processor – in accordance with § 7 of the data processing agreement, and will grant a right to object.

– Purpose: processing of payments (SEPA direct debit and credit card). – Place of business: Ireland (European Union). – Transfer basis: processing within the European Union; as a rule, no transfer to a third country takes place. Insofar as a transfer to the Stripe group of companies in the United States takes place, the EU-US Data Privacy Framework (adequacy decision (EU) 2023/1795), in the alternative the Standard Contractual Clauses (EU) 2021/914.

– Purpose: support and chat function on the website (integration by means of the click-to-load procedure). – Place of business: Ireland (European Union); group-affiliated processing also in the United States of America. – Transfer basis: for processing in the United States, the EU-US Data Privacy Framework (adequacy decision (EU) 2023/1795), in the alternative the Standard Contractual Clauses (EU) 2021/914 with supplementary safeguards.

– Purpose: protection against automated attacks and abusive use by means of the bot-protection service Cloudflare Turnstile. – Place of business: Cloudflare, Inc., United States of America; Cloudflare Ireland Ltd., Ireland (European Union). – Transfer basis: insofar as processing takes place in the United States, the EU-US Data Privacy Framework (adequacy decision (EU) 2023/1795), in the alternative the Standard Contractual Clauses (EU) 2021/914 with supplementary safeguards.

– Purpose: customer relationship management (CRM) as well as support and chat function on the website (integration by means of the click-to-load procedure); will in future replace the previous support and chat solution (Intercom, no. 2); until then, both remain in use. – Place of business: Frankfurt am Main, Germany (European Union). – Transfer basis: processing within the European Union; no transfer to a third country takes place.