Service providers and sub-processor

1. Purpose

AgeRail (Lalalu Marketing SL) uses the vendors below to deliver the hosted age-verification service. This page is the list incorporated by reference into the Data Processing Agreement at /dpa. Classification distinguishes the Article 28 sub-processor AgeRail directly engages for Controller Personal Data from controller-side service providers.

AgeRail configures the verification workloads it controls, and the storage of the data they produce, to run within the European Union. Vendor support, security, and telemetry activities incidental to those services are governed by the vendor terms stated below. Delivery of verification results to the Controller's own configured redirect or webhook endpoints is Controller-directed; the location of those endpoints is the Controller's choice and responsibility. Payment and email vendors process their respective data categories under the transfer mechanisms stated for each vendor.

2. Article 28 sub-processor (Controller Personal Data)

Google Cloud

• Classification: The Article 28 sub-processor AgeRail directly engages for Controller Personal Data under the DPA. Google Cloud engages its own sub-processors, identified in its published register linked below.
• Role: Cloud infrastructure host for AgeRail's verification and core service workloads
• Data category: Verification processing data, tenant account and configuration data, operational logs, and (when enabled) operator-only calibration records
• Region: European Union, for AgeRail verification and core service workloads
• Transfer mechanism: AgeRail configures the workloads it controls, and the storage of the data they produce, to run within the European Union under the Google Cloud Data Processing Addendum; vendor support, security, and telemetry activities incidental to those services are governed by that Addendum and the service-specific terms it references; delivery of verification results to the Controller's own configured redirect or webhook endpoints is Controller-directed (location is the Controller's choice and responsibility)
• Vendor DPA:cloud.google.com/terms/data-processing-addendum
• Downstream sub-processors:cloud.google.com/terms/subprocessors

3. Controller-side service providers

The following vendors process payment data and transactional email data as controller-side service providers of AgeRail for AgeRail's own commercial and operational purposes. They are not Article 28 sub-processors for Controller Personal Data under the DPA.

Stripe

• Classification: Controller-side service provider (not Art. 28 sub-processor for Controller Personal Data)
• Role: Payment processing for prepaid credit purchases and related billing events
• Data category: Payment and billing data (customer and payment-method references, amounts, tax identifiers where provided)
• Region: Global processing including the United States, as operated by Stripe
• Transfer mechanism: Stripe Data Processing Agreement; EU-US Data Privacy Framework and Standard Contractual Clauses where applicable
• Vendor DPA:stripe.com/legal/dpa

Postmark

• Classification: Controller-side service provider (not Art. 28 sub-processor for Controller Personal Data)
• Role: Transactional email delivery (service and account messages)
• Data category: Email content and delivery metadata (recipient address, subject, delivery events)
• Region: Processed by Postmark under its service infrastructure (including US processing where applicable)
• Transfer mechanism: Postmark Data Processing Agreement; EU-US Data Privacy Framework and Standard Contractual Clauses where applicable
• Vendor DPA:postmarkapp.com/dpa

4. Changes

Changes that add or replace an Article 28 sub-processor processing personal data under the DPA are governed by the sub-processor change-notification terms in the DPA (email notice at least 30 days before go-live).

5. Contact

Questions about this list: privacy@agerail.com.