ZAPP, S.L. · Effective from 12 November 2026
ZAPP uses the following sub-processors to provide its services. Under our data processing agreements and data transmission contracts, we notify our customers of any new or replacement sub-processor at least thirty (30) days in advance. Each customer may object on legitimate data protection grounds.
| Sub-processor | Address | Service | Data concerned | Processing location | Safeguard | Applies to |
|---|---|---|---|---|---|---|
| Scaleway SAS | 8 rue de la Ville-l'Évêque, 75008 Paris, France | Platform hosting (dedicated servers) and backups on encrypted S3 storage | All customer data | France | European Union | All SaaS customers |
| Scaleway SAS | Same address | AI models (Generative APIs) for the AI module, when ZAPP provides the AI provider; no data retention or training | Text sent by the AI module | France | European Union | Customers who enable the AI module with ZAPP's provider |
| OVH SAS | 2 rue Kellermann, 59100 Roubaix, France | Sending MyZapp support portal notifications | Name, email address and ticket subject | France | European Union | MyZapp portal |
| Cloudflare, Inc. | 101 Townsend St., San Francisco, CA 94107, United States | Bot protection (Turnstile) on website forms and on the platform login | IP address and technical browser data; no access to customer data | Global network | EU-US Data Privacy Framework and standard contractual clauses | ZAPP websites and SaaS instances using Turnstile, as stated in their order form |
Providers that customers choose and contract themselves are not ZAPP sub-processors: their own email account, when the Ecaldima platform sends emails through it, and their own AI provider, when configured in the AI module.