Sub-processors
This is the canonical, public list of third parties that Ett Två AB (doing business as “KeyGum”) engages as sub-processors to provide the Service. The same list is mirrored in Privacy Notice §4 and in DPA Annex III; this page exists so that auditors, controllers, and platform reviewers have a stable, easily-citeable URL.
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH | Application + database hosting (primary infrastructure) | Germany (EU) | N/A (EU) |
| Cloudflare, Inc. | CDN, DDoS protection, WAF, R2 object storage | Global edge; R2 buckets pinned to EU | SCCs + DPF |
| Amazon Web Services EMEA SARL | Transactional email delivery via SES | Ireland (EU) | N/A (EU) |
| Stripe Payments Europe, Ltd. | Payment processing, subscription billing, Stripe Tax (VAT) | Ireland (EU), with onward processing in the United States | SCCs + DPF (Stripe, Inc. US parent) |
| LinkedIn Ireland Unlimited Company | Publishing to LinkedIn on customer behalf via LinkedIn API | Ireland (EU), with onward processing in the United States | SCCs + DPF |
| Meta Platforms Ireland Ltd. | Publishing to Facebook, Instagram, and Threads via Graph API | Ireland (EU), with onward processing in the United States | SCCs + DPF |
| X Corp. (Twitter) | Publishing to X on customer behalf via X API | United States | SCCs |
| Google Ireland Limited (YouTube) | Publishing to YouTube on customer behalf via YouTube Data API | Ireland (EU), with onward processing in the United States | SCCs + DPF |
| TikTok Technology Limited | Publishing to TikTok on customer behalf via Content Posting API | Ireland (EU); engineering support in the United Kingdom and Singapore | SCCs + UK IDTA |
| Pinterest Europe Ltd. | Publishing Pins and retrieving Pin analytics on customer behalf via Pinterest API | Ireland (EU), with onward processing in the United States | SCCs + DPF |
Data-transfer safeguards
For every non-EU sub-processor we have Standard Contractual Clauses (SCCs, Implementing Decision (EU) 2021/914) in place as the primary safeguard. Where a sub-processor is certified under the EU–US Data Privacy Framework (DPF) we rely on both DPF adequacy and SCCs as belt-and-suspenders so that invalidation of either one does not interrupt service. UK transfers are additionally covered by the ICO's International Data Transfer Addendum (IDTA).
Change notice
We give at least thirty (30) days’ prior notice by email to the billing contact before adding a new sub-processor or materially changing the scope of an existing one’s processing. You may object during the notice period on reasonable grounds. If we cannot accommodate your objection, you may terminate under the Terms Section 6 without early-termination penalty.
Contact
Questions, objections, or requests for our SCC templates: privacy@keygum.com.
Ett Två AB, Sweden — privacy@keygum.com