Please note: this English text is a convenience translation. The German version (Unterauftragsverarbeiter) is the legally binding one.

When you use BlitzFin, we process the personal data in your project rooms on your behalf (Art. 28 GDPR). This is governed by our data processing agreement (DPA, German: AVV). For certain services we use the following subprocessors. This page is the list agreed in the DPA (Annex IV).

As of: October 2, 2026

Google Cloud EMEA Limited

Address: Velasco, Clanwilliam Place, Dublin 2, Ireland
Service: Cloud infrastructure: running the application, database, document storage and background jobs (Google Cloud Platform)
Data: All data processed in the platform (account, project, cost and log data, uploaded documents)
Location of processing: Germany (Frankfurt am Main)
Third-country transfer: No scheduled transfer. Where Google's own subprocessors act outside the EU (e.g. support), the EU standard contractual clauses or the EU-US Data Privacy Framework apply.

Google Cloud EMEA Limited (Vertex AI)

Address: Velasco, Clanwilliam Place, Dublin 2, Ireland
Service: AI-assisted reading of documents (e.g. invoices) with the Gemini language model via Google Vertex AI. Google does not use the content to train AI models; caching of inputs is disabled.
Data: Content of the documents being read (including any personal data they contain)
Location of processing: EU (data centers in member states of the European Union)
Third-country transfer: No scheduled transfer; processing in the EU region only.

Cloudflare, Inc.

Address: 101 Townsend Street, San Francisco, CA 94107, USA
Service: Delivery of the application at app.blitzfin.com and on customer domains: accepting the encrypted connection (TLS), forwarding to Google Cloud, protection against attacks
Data: IP addresses and technical connection data; the transmitted content while in transit
Location of processing: Global network; requests are normally processed in the nearest data center (for users in the EU: in the EU)
Third-country transfer: USA: EU-US Data Privacy Framework and EU standard contractual clauses

Brevo SAS

Address: 7 rue de Madrid, 75008 Paris, France
Service: Sending system emails (e.g. login links, notifications) and receiving emails at the invoice inbox addresses of the project rooms
Data: Email addresses, names, email content including attachments (e.g. invoices)
Location of processing: EU
Third-country transfer: No scheduled transfer.

Changes to this list

Before we add or replace a subprocessor, we inform our customers at least 14 days in advance by email to the address of the account owner or organization administrators stored in the account. You can object to the change within this period; the details are set out in the DPA. Contracts are in place with all subprocessors that impose on them essentially the same data protection obligations as apply to us.

Not on this list

For processing we carry out under our own responsibility – such as our website, the contact form, appointment booking, payment processing via Stripe or the onboarding form of the Construction Cost Calculator – we use further service providers. These are described in our privacy policy.

If you yourself connect BlitzFin to an AI assistant (e.g. ChatGPT or Claude), its provider is not our subprocessor: the data is transferred at your initiative to a service of your choice (see the privacy policy).