This list is Annex 2 to the Data Processing Agreement and is kept up to date. It names every service provider Timeveo uses that may process personal data from the platform.
They are engaged on the basis of the general authorisation under Art. 28(2) sentence 1 GDPR. Each one is contractually bound to a level of protection matching the DPA.
1. Subprocessors in use
| Company | Purpose | Data categories | Location / region | Safeguards |
|---|---|---|---|---|
| ONETSOLUTIONS SAS, 1 Allée de l’Ecluse, 33370 Yvrac, France (RCS Bordeaux 533 905 659) | Hosting and operation of the Timeveo application and database | All data stored in the platform | France (EU) | Processing within the EU, DPA |
| Cloudflare, Inc. | DNS, content delivery, attack protection, hosting of the landing and legal pages, tunnel for error monitoring, storage of the nightly error-monitoring backups (R2) | Connection data (IP address, user agent, requested URL), pilot waiting-list form data, backup copies of the error-monitoring data | USA, served from European edge locations; backups in R2’s EU jurisdiction | EU Standard Contractual Clauses, EU-US Data Privacy Framework, Cloudflare Data Processing Addendum |
| Oracle Deutschland B.V. & Co. KG (Oracle Cloud Infrastructure) | Operation of the self-hosted error monitoring (GlitchTip) and availability monitoring for the platform | Technical error messages and stack traces, pseudonymous tenant and user IDs, browser type and visited page without query parameters; IP and email addresses are removed before storage, no form contents; retained for 90 days | Germany (EU), Frankfurt am Main region; US parent company | Processing within the EU, Oracle Data Processing Agreement for Oracle Cloud Services, EU Standard Contractual Clauses or Binding Corporate Rules for Processors, EU-US Data Privacy Framework |
| Sendinblue SAS, trading as Brevo | Sending transactional email (booking confirmations, reminders, system messages) | Name, email address, message content, delivery status | France (EU) | Processing within the EU, DPA |
| seven communications GmbH & Co. KG (seven.io) | Sending SMS, in particular appointment reminders and one-time codes | Phone number, message content, delivery status | Germany (EU) | Processing within the EU, DPA |
| Twilio Ireland Limited | Fallback route for sending SMS when seven.io is unavailable | Phone number, message content, delivery status | Ireland (EU), parent company USA | EU Standard Contractual Clauses, EU-US Data Privacy Framework, Twilio Data Protection Addendum |
| Meta Platforms Ireland Limited | Sending WhatsApp messages over the WhatsApp Business Platform: one-time codes through Timeveo’s account, and appointment messages through your business’s own WhatsApp Business account, which is set up through Meta | Phone number, message content, delivery status; during set-up also your Meta account credentials towards Meta | Ireland (EU), parent company USA | EU Standard Contractual Clauses, EU-US Data Privacy Framework, Meta Data Processing Terms |
| Stripe Payments Europe, Limited | Billing the Timeveo plan; technically routing your clients’ payments through your own connected Stripe account (Stripe Connect) | Billing and contact data, payment references, transaction metadata; no full card details in Timeveo | Ireland (EU), US parent company | EU Standard Contractual Clauses, EU-US Data Privacy Framework, Stripe Data Processing Agreement |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payment processing during booking through your own PayPal account | Transaction metadata, payment references | Luxembourg (EU) | Processing within the EU |
| SumUp EU Payments UAB | Card payments at the point-of-sale terminal through your own SumUp account | Transaction metadata, terminal and receipt data; no full card details in Timeveo | Lithuania (EU) | Processing within the EU |
| fiskaly GmbH | Technical security device (cloud TSE) under KassenSichV, signing of till transactions, DSFinV-K export | Till and receipt data, timestamps, signature counters | Austria (EU) | Processing within the EU, DPA |
Payment providers: Stripe, PayPal and SumUp additionally process payment data as independent controllers where they meet their own regulatory duties and carry out fraud prevention. The contract covering your clients’ payments is directly between you and the respective provider. See Responsibilities.
2. Changes and objection
Timeveo announces the engagement of a new subprocessor or the replacement of an existing one at least 30 days before activation by email to the administrator address stored in the account. The change is also recorded in the change log on this page.
You may object within the notice period on important data protection grounds. If the objection cannot be resolved, both parties have a right of extraordinary termination under section 8 of the DPA.
3. Change log
| Date | Change |
|---|---|
| 2026-08-20 | First publication of the list with eight subprocessors. |
| 2026-09-17 | Oracle Deutschland B.V. & Co. KG added for the self-hosted error monitoring; Cloudflare extended with the error-monitoring tunnel and the backups in R2. |
| 2026-09-26 | Full legal name and address of the hosting provider ONETSOLUTIONS SAS added. seven communications GmbH & Co. KG added as the SMS provider (Twilio remains the fallback) and Meta Platforms Ireland Limited for WhatsApp messages. |
| 2026-09-29 | No subprocessor added or removed. Three third-party embeds that were never processing on our behalf are gone: Google Fonts on the booking pages, Bunny Fonts in the admin interface and ui-avatars.com for placeholder pictures. We now serve fonts and placeholder pictures ourselves. The Google Maps map on the booking pages and the address search in the location settings only load after a click. |
4. Open items
The contracting Oracle entity will be confirmed against the Oracle Cloud contract; until then the German subsidiary is named. This does not change where the data is processed (Frankfurt am Main, EU).
Version 1.3, effective 29 September 2026.