Sub-processors
The contracting party and invoice issuer is the operator ([to follow]); Wichtli is one of its brands.
List
Stored in the EU (Cloudflare D1, EU jurisdiction). Some providers are US-based, safeguarded by the Data Privacy Framework and standard contractual clauses. Providers marked «not yet active» receive no data until they are activated.
| Provider | Purpose | Country of seat | Storage / processing location | Transfer mechanism | Status |
|---|---|---|---|---|---|
| Cloudflare Inc. (Workers, D1, R2, CDN) | hosting, DB | US (parent) | EU storage (D1 EU jurisdiction); global edge | DPF (EU-US, Swiss-US) + SCCs in the Cloudflare DPA | active |
| Cloudflare Email Service | transactional mail, chat relay | US (parent) | global edge, transit only | DPF + SCCs (Cloudflare DPA) | not yet active |
| Stripe Payments Europe Ltd. / Stripe Inc. | payment (business contact + card data; Stripe is independent controller for payment compliance) | IE / US | EU/US | Stripe certified to EU-US DPF incl. Swiss-US DPF; Data Transfers Addendum as fall-back | not yet active |
| Gelato (print, gift, home delivery) | process recipient name and address | NO (EEA) | CH/EU/EEA, only once confirmed in writing (DPA or API setting) before activation; Gelato's own sub-processors listed or linked here before activation | EEA, adequate; signed DPA before activation | not yet active |
| Prodigi Group Ltd (print, backup) | process recipient name and address | UK | UK, EU; CH/EU/EEA/UK only once confirmed in writing before activation | UK adequacy (CH and EU) | not yet active |
| Swiss Post (when live) | printing and posting postcards: the recipient's name and office address, first name on the front, card text | CH | CH, only once confirmed in writing before activation | none needed (domestic) | not yet active |
| AI/GIF generation provider (if used) | personalised GIFs | not yet chosen | not yet chosen | only with DPA; no real photos of persons uploaded at launch, text-based personalisation only | not yet active |
Changes
We announce new or changed sub-processors to our customers by email 30 days ahead; right to object under the DPA. Questions: privacy@wichtli.ch.