A sub-processor is a company that PhraseMine LLC engages to process personal data on behalf of our customers, such as the responses collected by their forms. This page is Annex III of our Data Processing Addendum and complements our Privacy Policy.
How we choose sub-processors#
We use as few providers as we can. Before we engage one, we check that it offers appropriate security, that it signs a data processing agreement with data protection obligations no less protective than those in our DPA, and that transfers outside the European Economic Area are covered by a recognised safeguard (such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework). We remain responsible for our sub-processors.
Our main data stays in Germany: the HornetForms database, uploaded files and nightly backups are on our servers at Hetzner. Off-site backups are encrypted before they leave our servers, so the storage provider cannot read them.
How we announce changes#
We give at least 30 days' notice before a new sub-processor starts processing customer personal data. We update this page (including the date below) and email everyone who has subscribed. To subscribe, email info@hornetforms.com with the subject "Subscribe to sub-processor updates". You can object to a new sub-processor as described in section 6 of the DPA.
What is not on this list#
- Uptime monitoring: we use UptimeRobot and healthchecks.io to check that public addresses respond and that scheduled jobs ran. They receive no personal data, so they are not sub-processors.
- Destinations you choose: when you send responses to your own email inbox, webhooks or API clients, or add Google Analytics, Google Tag Manager or the Meta Pixel to your forms, those providers work for you, not for us. Choosing them and having the right agreements with them is your responsibility.
- Content you embed: videos, maps and scheduling widgets embedded in your forms (for example YouTube, Vimeo, Loom, Calendly or Google Maps) load directly from those providers.