Subprocessors and other recipients
Version: 2026-10-16
This page lists the service providers that process personal data for CyberLab.Team OÜ, and other recipients of data, for the Website cyberlab.team, the Client Cabinet on *.cyberlab.team and our services. It is Annex 3 of our Data Processing Agreement. We notify clients by email from info@cyberlab.team and on this page at least 30 days before adding or replacing a subprocessor; clients may object (DPA §3.2). Questions: info@cyberlab.team.
1. Subprocessors (they process data on our behalf)
| Provider | Location | What they do for us | Data | Transfer safeguard |
|---|---|---|---|---|
| OVHcloud (OVH SAS, France) | France (EU) | Hosting of the Client Cabinet, its databases and client workspaces | All Client Cabinet data | EU — no transfer |
| Hetzner Online GmbH (Germany) | Finland and Germany (EU) | Monitoring and error tracking (self-hosted), administrative access server | Error reports and logs that may contain user identifiers, IP and email addresses; no Client Cabinet database or uploads | EU — no transfer |
| Cloudflare, Inc. | Global network; backups stored in the EU | Website and Client Cabinet delivery and security (CDN, DNS, firewall, tunnels), bot protection on forms and sign-in (Turnstile; for improving its own bot detection Cloudflare acts as an independent controller under its Turnstile privacy policy), cookieless statistics, storage of our encrypted backups (R2) | IP addresses and request data; encrypted backups | EU-US Data Privacy Framework and Standard Contractual Clauses |
| Google Cloud (Google) | Secret Manager in Paris (EU) | Secure storage of our service credentials and access identities | No client personal data | Google Cloud Data Processing Addendum |
| Google Workspace (Google) | Google's data centres | Our business email at info@cyberlab.team, including enquiries from the Website and correspondence with clients | Anything you write to us | Google Cloud Data Processing Addendum (SCC / DPF) |
| Resend (Plus Five Five, Inc., USA) | USA | Delivery of emails: sign-in links, notices, reports, Website form messages | Recipient address, subject, email content, delivery data | EU-US Data Privacy Framework; Standard Contractual Clauses |
We do not use a CRM. We currently use no external AI providers for client content or data received from Google; any future AI provider will be added here with 30 days' notice (Privacy Policy §5).
2. Independent controllers (they process data under their own terms)
| Recipient | Role | Data |
|---|---|---|
| Google (Google Ireland Limited and Google group) — Google Business Profile, Google sign-in, Google Ads | Provides the Google services you use; we work in them on your instructions | Business Profile data, sign-in identity, advertising account data |
Google Ireland Limited — Google Analytics 4 on cyberlab.team |
Website analytics and Google's advertising features, only with your consent | Usage data and identifiers (Cookie Policy) |
| Stripe Payments Europe, Limited (Ireland) | Card payments and payment pages; some processing on Stripe's own behalf | Billing contact, order and payment data; card data entered only with Stripe |
| Telegram Messenger Inc. | Internal notifications to our staff | Only an internal event number and a link to our staff console; no client names, contact details, business names or message content |
| Revolut, Wise | Banks receiving bank transfers | Payer name and bank details |
| Our accountants and legal advisers | Professional services bound by confidentiality | Invoices and documents necessary for their work |
Where one of these recipients processes personal data on our behalf for a particular service (for example Google under its data processing terms for Google Analytics measurement or for data we upload to Google Ads, or Stripe for parts of payment processing), its data processing terms apply to that service; for its own purposes it acts as an independent controller (DPA Section 3.3). Cloudflare acts as an independent controller only for the signals it uses to improve its own Turnstile bot detection (Section 1).
3. Code hosting
Our source code is hosted at GitHub (GitHub, Inc.). Client personal data is not stored there.