SUB-PROCESSORS

Sub-processors

Third parties that process personal data on PersoHR's behalf, disclosed under GDPR Article 28(2).

Last updated: May 2026

PersoHR uses the following sub-processors to deliver the service. Each is bound by a data-processing agreement equivalent to the obligations PersoHR commits to in its own DPA. We notify the account owner at least 30 days in advance of any intended change to this list and offer the right to object.

  • Hetzner Online GmbH (Cloud Database)

    Managed PostgreSQL hosting for all application data

    HR app data
    Location
    Germany (EU)
    Registered address
    Industriestr. 25, 91710 Gunzenhausen, Germany
    Transfer mechanism
    EU processing only — no transfer mechanism required
    Categories of personal data
    • All personal data stored by the platform

  • Hetzner Online GmbH (Object Storage)

    S3-compatible storage for documents, avatars and exports

    HR app data
    Location
    Germany (EU)
    Registered address
    Industriestr. 25, 91710 Gunzenhausen, Germany
    Transfer mechanism
    EU processing only — no transfer mechanism required
    Categories of personal data
    • Document files
    • Avatar and cover images
    • GDPR data exports

  • Mistral AI

    AI inference for the in-app HR assistant, onboarding suggestions, document analysis and review drafting

    AI inference
    Location
    France (EU)
    Registered address
    15 rue des Halles, 75001 Paris, France
    Transfer mechanism
    EU processing only — no transfer mechanism required
    Categories of personal data
    • AI prompts and responses
    • Selected employee data only when explicitly included by the user

  • Brevo (Sendinblue SAS)

    Transactional email delivery (welcome, magic-link, notifications, billing)

    Email delivery
    Location
    France (EU)
    Registered address
    7 rue de Madrid, 75008 Paris, France
    Transfer mechanism
    EU processing only — no transfer mechanism required
    Categories of personal data
    • Recipient email address
    • Recipient first name
    • Email subject and body content

  • Stripe Payments Europe Limited

    Subscription billing, payment processing, invoicing and tax collection

    Billing data
    Location
    Ireland (EU) with onward transfer to Stripe Inc., United States
    Registered address
    1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland
    Transfer mechanism
    Standard Contractual Clauses (Decision 2021/914/EU) plus Stripe's additional safeguards
    Categories of personal data
    • Account owner name and email
    • Billing address and VAT identifier
    • Payment method tokens (no raw card data on PersoHR systems)

  • Plausible Insights OÜ

    Cookieless web analytics for the marketing site and the public-facing app authentication flow. Logged-in app pages are not tracked.

    Web analytics
    Location
    Estonia (EU)
    Registered address
    Västriku tn 2, 50403 Tartu, Estonia
    Transfer mechanism
    EU processing only — no transfer mechanism required
    Categories of personal data
    • Anonymised IP address (hashed at edge, never stored in raw form)
    • Page URL and HTTP referrer
    • User agent string
    • No cookies, no persistent identifiers, no personal data

DeepL (deepl.com) is used by PersoHR only for offline / development-time translation of system-seeded content (static localisation data and database migration values). No customer personal data is ever sent to DeepL, so it is intentionally not listed above as a sub-processor. If that ever changes we will add DeepL with the appropriate transfer mechanism and notify account owners 30 days in advance per our usual sub-processor change procedure.

If you would like to be notified by email of changes to this list, please email privacy@persohr.eu.