Sub-processors

This document is published in several languages. In the event of any discrepancy between the language versions, the Polish version is binding.

Version 1.1 · Last updated: 22 October 2026

Which third parties receive data at formexposed, for what purpose, where and on what basis. This list forms part of the Data Processing Agreement as Annex 3. Approved sub-processors within the meaning of that agreement are only those listed in section 2; sections 3 to 6 provide information on further recipients and do not constitute an approval.

1. The short answer

We operate the servers, database and computing power, including for the language model, ourselves in Poland. No hosting, cloud or AI provider is involved. Sub-processors within the meaning of Art. 28(2) and (4) GDPR, that is, third parties that process our Customers’ data on our behalf, exist for only one task: e-mail.

In addition, there are recipients that are not sub-processors. We nevertheless list them here, separated by the reason, so that the picture is complete:

• recipients that process data as independent controllers (section 3),
• recipients that the Customer chooses when having alerts sent there (section 4),
• queries to third parties that contain no personal data (section 5).

2. Sub-processors

Recipient and registered office	Purpose	Data	Place of processing	Basis for transfer
Namecheap, Inc. (Private Email), Phoenix, Arizona, USA	Sending the service’s e-mails (confirmations, alerts, reports, monthly reports to subscribers of a client portal); delivery check mailbox	E-mail addresses of recipients, subject and content of the e-mails. In the delivery check mailbox: copies of the form e-mails from Customer websites with everything visitors enter there, until we process them	Still to be verified	The provider’s data processing agreement; whether data goes to a third country and on what basis is still to be verified, see section 7
Namecheap, Inc., Phoenix, Arizona, USA	Registration of the domains, DNS; until the mailbox at Namecheap, Inc. (Private Email), Phoenix, Arizona, USA is set up, forwarding of general e-mails to addresses at our domain. The control copies of the delivery check do not pass through Namecheap; they go directly to the mailbox	Domain data; for forwarding, content and headers of general e-mails to us, no copies of form e-mails	USA, to be verified	Namecheap’s Data Processing Addendum; standard contractual clauses or Data Privacy Framework – to be verified, see section 7

Whether a Customer’s processor data reaches these recipients at all depends on their settings: without the delivery check, no form e-mails go there; without a client portal, no e-mails go to its subscribers. We will provide the data protection contact point of each sub-processor on request.

Not involved: No third party is involved in checks, screenshots, credentials for the scan behind the login, browser journeys or “Fix it for me”. The language model runs on our own server. We determine the country of an IP address from a local database file; no address goes to a geolocation service. Our internet service provider only passes traffic through, mostly encrypted, and is not a sub-processor.

3. Recipients acting as independent controllers

Recipient and registered office	Purpose	Data	Location	Basis
Stripe Payments Europe, Ltd., Dublin, Ireland; for transfers to the USA, Stripe, Inc.	Payment processing and invoices for customer accounts	E-mail address, name, billing address, VAT ID, payment details (entered only at Stripe, they never reach us); on our side only the customer and subscription ID and status	EU / USA	For payment data, Stripe largely acts as an independent controller; the exact allocation of roles is to be verified. Transfer to the USA: Data Privacy Framework or standard contractual clauses – to be verified
Google Ireland Limited, Dublin, Ireland; Google LLC, USA	Bot protection (reCAPTCHA) on our own forms: registration, login, password, free check, header tool, opt-out, support and contact	IP address, browser and device data, behaviour on the page, Google cookies. The script is loaded only on submission. It does not run on Customers’ websites	EU / USA	Google’s terms; Data Privacy Framework or standard contractual clauses – to be verified

These recipients concern our own processing, not processor data. Details are in the Privacy Policy.

4. Recipients chosen by the Customer

Alerts and digests go wherever the Customer wants them: by e-mail (via the mail service provider in section 2), to a webhook address or to a chat service. The current options are:

• Slack, Discord, Microsoft Teams and Google Chat via an address that the Customer creates in their account with that service;
• Telegram: a destination chosen by the Customer; we send the message via our bot after the recipient has linked the chat to the bot themselves;
• webhooks to any public HTTPS address on the standard port, signed on request.

Data: domain, event, time and a link into the service, for alerts about a check to its report, which can be read via this link without signing in; for webhooks, the same details in machine-readable form. No content of form e-mails; an alert from the delivery check may name the sender’s e-mail domain if it does not belong to the website.

Role: Slack, Discord, Microsoft Teams, Google Chat and the recipients of webhooks are not our sub-processors. The transfer happens only because the Customer sets up the destination; that is the Customer’s instruction. For Slack, Discord, Microsoft Teams, Google Chat and webhooks, the contractual relationship with the respective provider and any basis required for a transfer to a third country lie with the Customer. For Telegram, we send the message via our own bot; here too, choosing the destination is the Customer’s express instruction to transfer the alerts there. Whether Telegram is our sub-processor in this respect and on what basis this transfer takes place has not yet been conclusively settled and is with our lawyer for review. Should Telegram be a sub-processor, the Customer’s choice of this destination is deemed to be the Customer’s specific authorisation under Art. 28(2) GDPR for this purpose. Several of these providers process data in the USA; Telegram is based outside the EU in a country without an adequacy decision, and the basis under Chapter V GDPR on which the transfer to Telegram takes place has not yet been conclusively settled. Anyone who does not want this chooses e-mail or another destination.

5. Queries without personal data

Some functions query third parties. Only domain names, server addresses, check values or version numbers go out, no details about Customers or visitors. These third parties are therefore not sub-processors.

Recipient	Purpose	What goes out
RDAP services of the domain registries, found via the IANA directory; for checking the domain age in the free check, via the rdap.org relay service	Age and expiry of a domain	only the domain name
WPVulnerability (wpvulnerability.net)	Known security vulnerabilities in WordPress, WordPress extensions and themes	only the identifier of an extension or a theme, or the version number of WordPress
Status pages of providers that Customers use (such as CAPTCHA and mail services)	Notice of outages at these providers	nothing except the request itself
Timestamping authorities Certum (Asseco Data Systems S.A., Poland), alternatively DigiCert, Inc. (USA)	Timestamps for evidence logs	only a check value (SHA-512) of the log, not its content
DNS blocklists for spam: SpamCop, PSBL, Mailspike and SURBL (Spamhaus only with its own access)	Checking whether a Customer’s mail server or domain is listed	domains and IP addresses of servers (mail servers, web servers), no personal data of visitors
Google Web Risk, only if set up	Checking a Customer’s home page for listings due to malware or phishing	only the address of the home page
Telegram, operational notifications	Signals to the operator in the event of outages and new support requests	fixed texts without sender, content or addresses
Certificate authority for TLS	Issuing the certificates for our domains	only our own domain names

6. Prepared, not currently in use

The service can have browser checks and form requests additionally confirmed from a second, independent location. This checkpoint is not currently set up. If a third party operates it later, that party is a sub-processor and will be announced beforehand in accordance with section 8. It would receive the domain, the cleaned configuration of the browser journey and a job ID, but no credentials and no details from visitors.

7. What is still open

This list is a pre-launch draft. We say openly what has not yet been settled:

• Mail service provider: Namecheap, Inc. (Private Email), Phoenix, Arizona, USA is intended. Where the provider processes the data and on what basis it may go to a third country is still to be verified. Whether the provider’s data processing agreement has been accepted for this use, where the mailboxes are actually located, which further sub-processors the provider uses and which module of the standard contractual clauses applies is still to be documented. The publicly available Data Processing Addendum alone does not prove that a contract has been concluded. Until this has been documented, no processor data goes out via this provider; it must therefore be settled before launch.
• Data Privacy Framework: We have not checked for this version whether Namecheap, Stripe and Google are certified under the EU-U.S. Data Privacy Framework for the services concerned. We therefore do not claim it; where certification is lacking, standard contractual clauses apply.
• Role of Stripe for the individual data.
• Telegram alerts: the basis for the transfer when a Customer chooses Telegram as a destination and we send the message via our bot.

8. Changes to this list

We engage sub-processors on the basis of the general authorisation in the Data Processing Agreement. Before a new sub-processor starts processing or an existing one is replaced, we inform Customers at least 30 days in advance by e-mail to the account holder’s address and announce the change on this page and in the overview Changes to the Contract Documents. The notice states the recipient, registered office, purpose, data, location and basis for the transfer.

Within this period, the Customer may object in text form for a reasonable data protection reason. Until a solution has been found, we will not use the new sub-processor for the Customer’s processor data or will suspend the affected function for the Customer. If no solution can be found, the Customer may terminate the contract for the service or the affected service component; we will refund, on a pro rata basis, any fees paid in advance for the period after termination. The details are set out in the Data Processing Agreement. We are liable to the Customer for sub-processors as for our own acts.

We publish changes in sections 3 to 5 that do not concern sub-processors here with a new version number, without advance notice.

9. Status and version

• Version 1.1 · Last updated: 22 October 2026 · in the event of discrepancies between the language versions, the Polish version prevails instead of the German one; no other change.
• Version 1.0 · Last updated: 11 October 2026 · first version as a separate page; previously Annex 3 to the Data Processing Agreement. New: separation into sub-processors, recipients acting as independent controllers, destinations chosen by the Customer and queries without personal data; open points expressly named.
• In the event of discrepancies between the language versions, the Polish version prevails.