Subprocessors
Last updated: October 7, 2026
The German version of this document is the legally binding original. Translations into other languages are provided as a courtesy; in case of discrepancies, the German version prevails.
Overview
Capwork e.U. (Owner: Nikolas Kain) uses the subprocessors listed below to provide the Capwork service. This list is provided pursuant to Art. 28(2) GDPR and our Data Processing Agreement (AVV).
Each subprocessor is contractually obligated to maintain a level of protection equivalent to GDPR requirements. Third-country transfers occur exclusively on the basis of appropriate safeguards (EU-US Data Privacy Framework and/or Standard Contractual Clauses pursuant to Module 2/3).
List of subprocessors
| Provider | Purpose | Data categories | Region / location | Transfer legal basis |
|---|---|---|---|---|
| Google Cloud Platform (Google Ireland Ltd.) | Hosting, database, application runtime, logging, secret management, storage | All personal data processed in the course of using the service (contact data, bookings, invoices, content) | europe-west1, europe-west4, eur3 | EU-US DPF + SCCs (Module 2/3) |
| Firebase Authentication / Identity Platform (Google Ireland Ltd.) | User authentication, session tokens | Email address, authentication tokens, IP address, sign-in timestamps | EU | EU-US DPF + SCCs (Module 2/3) |
| Vertex AI — Gemini & Anthropic Claude (Google Ireland Ltd.) | AI inference (Google Gemini as well as partner models such as Anthropic Claude, operated via Vertex AI) for feedback analysis, insights, OCR, order context and the transcription of dictated notes | Text inputs to AI features (anonymized/aggregated where possible) and recordings of dictated notes (not stored by Capwork) | europe-west1, europe-west4, eu | EU-US DPF + SCCs (Module 2/3) |
| Stripe Payments Europe Ltd. | Payment processing, billing, EU VAT/OSS tax management | Name, email, billing address, VAT ID, payment method details (processed by Stripe itself, never by Capwork) | Ireland (EU) | Within EU — no transfer |
| Twilio Ireland Limited | Sending and receiving SMS and WhatsApp messages | Phone number, message content, delivery status | Ireland (EU) | Within EU — no transfer |
| Bird B.V. | Sending transactional email and SMS (appointment confirmations, reminders, earlier-slot offers, login codes for the customer portal, field work notices such as on the way, running late, work report and confirmation link) on the business's behalf; also sending and receiving the messages of the business's own email and SMS channels, including SMS on a dedicated number Capwork holds for the business. Where the business uses its own Bird account, Bird processes those messages under the contract between the business and Bird. | Email address, phone number, message content, delivery status | Amsterdam, Netherlands (EU, data region eu1) | EU provider; SCCs for its sub-processors outside the EEA |
| Google Workspace / Gmail (Google Ireland Ltd.) | Sending platform emails to registered users (welcome and onboarding messages) | Name, email address, message content (including the accepted legal documents as attachments) | EU | EU-US DPF + SCCs (Module 2/3) |
| Google Maps Platform (Google Ireland Ltd.) | Address search, map and distance calculation (geocoding, distance matrix) for appointment, order, and vehicle features | Entered or stored address data; when loaded on public pages, the device’s IP address | EU / global | EU-US DPF + SCCs (Module 2/3) |
Changes and right to object
Capwork notifies controllers at least 30 days in advance of adding a new subprocessor, by email to the stored contact address and by updating this list.
Controllers may object within this period. In case of a legitimate objection, the parties will jointly seek a solution; if this is not possible, both sides have a right of extraordinary termination.