Subprocessors

This list is Annex 2 to the data processing agreement (DPA). It names all subprocessors we use when we process data on behalf of the Customer, meaning the organizer a workspace is set up for at TickySmart (Art. 28(2) and (4) GDPR).

Always in use

Hetzner Online GmbH

Industriestr. 25, 91710 Gunzenhausen, Germany

• Service: data centers for servers, database, files and backups
• Data: all data stored in TickySmart (Annex 1 to the DPA)
• Location: Germany

Mailgun Technologies, Inc.

112 E Pecan St. #1135, San Antonio, TX 78205, USA

• Service: sending emails such as order confirmations, tickets, invoices and notifications, including from the Customer’s own sender addresses
• Data: name and email address of recipients, content of the emails including attachments such as tickets and invoices as PDF, delivery status
• Location: Mailgun’s EU region; access from the USA is possible and safeguarded by EU standard contractual clauses

Only for certain features

These service providers only receive data when the Customer, its team or a buyer uses the feature in question.

OpenAI Ireland Ltd

1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland

• Service: AI features: writing and translating texts, reviewing events, event from poster, importing a website or ticket shop, chat assistant
• Data: whatever the Customer or its team gives to an AI feature, such as event texts, posters or questions in the chat. If the team asks the chat assistant about orders or customers, this data goes to the model as well. Not used for training.
• Location: processing in the USA possible, safeguarded by EU standard contractual clauses and the EU-US Data Privacy Framework

Anthropic, PBC

548 Market Street, PMB 90375, San Francisco, CA 94104, USA

• Service: AI features as with OpenAI, when we use a model from Anthropic for them
• Data: as with OpenAI. Not used for training.
• Location: USA, safeguarded by EU standard contractual clauses

Google Ireland Limited

Gordon House, Barrow Street, Dublin 4, Ireland

• Service: Google Wallet, only when a buyer saves their ticket there
• Data: event, date, ticket type, name on the ticket and QR code
• Location: EU, processing in the USA possible, safeguarded by EU standard contractual clauses and the EU-US Data Privacy Framework

Apple Distribution International Ltd.

Hollyhill Industrial Estate, Hollyhill, Cork, Ireland

• Service: Apple Push Notification service: a notice to the device when a ticket in Apple Wallet changes, only when a buyer saves their ticket there
• Data: the device identifier only, no ticket content
• Location: EU, processing in the USA possible, safeguarded by EU standard contractual clauses and the EU-US Data Privacy Framework

Not subprocessors

These services are not on the list because the Customer connects them itself (§ 2(2) of the DPA) or because no buyer data goes to them:

• Payment providers such as Stripe, Mollie and PayPal: the Customer connects its own account and has its own contract. Buyers enter card and account details directly with the payment provider.
• Tracking and advertising such as Meta, Google and TikTok: the Customer sets them up in its shop, and they only load with the buyer’s consent.
• Webhooks, API keys and AI assistants such as ChatGPT or Claude via MCP access: data goes to the destinations the Customer connects itself.
• Public directories such as MusicBrainz and Wikipedia for artist info: we query them with the artist’s name only.
• EAS Update by Expo (650 Industries, Inc., USA) for updates of the TickySmart app: only the IP address, platform, app version and a random identifier of the installation leave TickySmart.

For data we are responsible for ourselves, such as team accounts, billing, support and visits to this website, our privacy policy applies.

Changes and questions

Before we add or replace a subprocessor, we inform the Customer by email at least 30 days in advance and update this list. Until the period has expired, no data goes to the new service. The Customer can object for an important data protection reason (§ 8 of the DPA). If a service has to be replaced at short notice because of an outage or a security problem, the period can be shorter.

We answer questions about our service providers at support@tickysmart.io and provide evidence on request (§ 10 of the DPA).