List of sub-processors
Last updated: [TO BE COMPLETED: publication date] · Version 1.0.
This page lists all subprocessors involved in the processing of your personal data as part of the Promastro service (promastro.be).
In accordance with Articles 28 and 30 of the Règlement général sur la protection des données (RGPD) (General Data Protection Regulation) and the transparency owed to users, this list is kept up to date. Any substantial modification (addition of a non-substitute subprocessor, change of location, additional transfer outside the EU) is notified by email to the affected users at least 30 jours (30 days) before its effective date, allowing you the possibility to object to the processing or terminate your account.
Summary
- Number of active subprocessors: 7
- Subprocessors located in the EU/EEA: 5
- Subprocessors outside the EU/EEA: 2 (United Kingdom — adequacy decision, United States — SCCs)
- No advertising subprocessors, no data brokers, no profiling brokers
Detailed List of Subprocessors
1. Mollie B.V.
| Purpose | Payment processing (credit cards, Bancontact, SEPA mandates), invoicing |
| Data processed | Last name, first name, email, billing address, card data (PCI-DSS — not visible to Promastro), transaction history |
| Headquarters | Amsterdam, Netherlands (EU) |
| Hosting | European Union |
| Framework | DPA Mollie + PSP authorization by the Dutch Central Bank (DNB) — compliant with RGPD + DSP2 |
| Documentation | Mollie Privacy Policy |
2. Sendinblue SAS (Brevo)
| Purpose | Sending transactional emails (registration, payment, notifications) via SMTP relay and API |
| Data processed | Recipient email, last name/first name, email content (template configured on Promastro side) |
| Headquarters | Paris, France (EU) |
| Hosting | European Union (Germany) |
| Framework | DPA Brevo compliant with RGPD — click tracking disabled |
| Documentation | Brevo Privacy Policy |
3. Anthropic PBC — United States Transfer
| Purpose | Claude AI model — automated moderation of reviews and descriptions, natural language search, description writing assistance, FR/NL/EN translations |
| Data processed | Review text (moderation), search query (natural language), description draft or text to be translated (only upon explicit consent from the Pro). No identifying data (email, TVA, GPS, address) is ever sent to Anthropic |
| Headquarters | San Francisco, California, United States |
| Hosting | United States (with potential use of AWS / GCP — see Anthropic DPA) |
| Framework | DPA Anthropic + Clauses contractuelles types (CCT/SCCs) (Standard Contractual Clauses) Module 2 — European Commission, June 2021 version. Contractual commitment by Anthropic not to use the data to train its models (standard API clause). Schrems II Transfer Impact Assessment (TIA) documented and available upon request. |
| Supplementary measures | Minimization of data sent, end-to-end TLS encryption, call logging (audit), retention limited to 30 jours (30 days) on Anthropic side then deletion |
| Documentation | Anthropic Policy · Anthropic DPA |
4. Horus / Falco SA
| Purpose | Issuance of electronic invoices in PEPPOL / UBL format, compliance with Belgian B2B invoicing 2026 |
| Data processed | Company name, TVA (VAT number), billing address, invoice lines, amounts, payment method and status |
| Headquarters | Belgium (EU) |
| Hosting | European Union |
| Framework | DPA Falco compliant with RGPD |
| Documentation | falco-app.be |
5. Contabo GmbH
| Purpose | Hosting of production server: WordPress application, MariaDB database, user files (photos, encrypted KYC) |
| Data processed | All Site data (in the passive hosting sense — no logical access to content by Contabo) |
| Headquarters | Munich, Germany (EU) |
| Hosting | Germany (EU) — Nuremberg datacenter |
| Framework | DPA Contabo compliant with RGPD — ISO 27001 (datacenters) |
| Documentation | Contabo Data Protection |
6. OpenStreetMap Foundation — United Kingdom (adequacy decision)
| Purpose | Provision of map backgrounds (map tiles) displayed on profile pages and geo-pages |
| Data processed | Visitor’s IP address (when loading tiles — standard HTTP request, anonymous), coordinates of the displayed area (latitude/longitude) |
| Headquarters | Cambridge, United Kingdom |
| Hosting | United Kingdom + EU mirrors |
| Framework | Transfer governed by the United Kingdom adequacy decision (Commission Decision (EU) 2021/1772) |
| Documentation | OSMF Privacy Policy |
7. European Commission — VIES
| Purpose | Automated verification of intra-Community VAT number at the time of Pro registration |
| Data processed | VAT number (sent in clear text for verification, never stored in clear text on Promastro side), return: validity status + company name |
| Headquarters | Brussels, Belgium (EU) |
| Framework | Official public service of the European Union — legal basis: legitimate interest (fight against fraud) |
| Documentation | VIES |
Optional Subprocessors (depending on configuration)
Twilio / Bird — SMS (if enabled)
If you enable SMS notifications in your account, the phone number and message content may be processed by Twilio Inc. (United States, under SCCs) or Bird (Netherlands, EU) depending on the provider selected by Promastro. The functionality is disabled by default.
Excluded Subprocessors
For information and transparency purposes, Promastro has made the deliberate choice not to use the following services:
- Google Analytics — replaced by Plausible Analytics (privacy-friendly, without third-party cookies);
- Google Maps — replaced by OpenStreetMap;
- Google reCAPTCHA — not used;
- Facebook Pixel / Meta Ads — not used;
- DeepSeek (Chinese AI) — formally excluded (Belgian DPA investigation, data outside EU without SCCs);
- OpenAI / ChatGPT — not used (Claude/Anthropic selected for its stricter contractual guarantees on non-training of models);
- Any data broker, any advertising broker, any ad-tech platform.
Notification Procedure in Case of Change
Any addition of a new non-substitute subprocessor or any substantial modification to this list (change of location outside the EU, new international transfer, change of purpose) is:
- Published on this page with update of the version number and date;
- Notified by email to affected users at least 30 jours (30 days) before effective date;
- Subject to your right to object: you may object to the new subprocessor by writing to rgpd@promastro.be. If the objection makes contract execution impossible, you may terminate your account without fees.
Version History
- v1.0 — Initial publication, 7 active subprocessors.
Contact
For any question regarding a subprocessor or to request a copy of a DPA: rgpd@promastro.be.
