Sub-processors
This is a translation. Where it differs from the original, the German version prevails.
Last updated: 29 October 2026
This page lists the sub-processors we use for your guests' data. For this data you are the controller and we are your processor; the list is Annex 3 of the data processing agreement (DPA) that you accept in the application. It applies equally to Einlasshelden and GateHeroes. You can read the full agreement at admin.gateheroes.events/auftragsverarbeitung.
Before we engage an additional sub-processor or replace an existing one, we inform you in text form 30 days in advance, by e-mail. If a sub-processor drops out unforeseeably (for instance through insolvency, a personal data breach at the sub-processor or a complete failure of its service), we replace it immediately with the sub-processor named below as a reserve and inform you without undue delay afterwards; further exceptions to the notice period are set out in DPA § 5 para. 2. You may object to the change in text form within 30 days of being informed for objectively justified reasons of data protection law; after a justified objection you may terminate the Main Contract for cause (DPA § 5 para. 2). A changed list is information and does not require a new acceptance of the DPA.
Sub-processors
Hetzner Online GmbH
- Place of business: Gunzenhausen, Germany
- Service and data: hosting and server operation (cloud VPS, object storage, backup storage); processes all personal data stored in the database and the file storage.
- Place of processing: Germany (servers, file storage); Finland (encrypted backups); both EU.
Mailjet
- Place of business: France (Mailjet SAS, part of the Sinch AB group)
- Service and data: sending the e-mails to your guests (invitations, confirmations); receives the recipient's e-mail address, the subject and the full message text, which may contain names.
- Place of processing: EU; a transfer to the USA is possible (sub-processors of the Sinch group), based on EU standard contractual clauses (Art. 46(2)(c) GDPR) and the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR).
Amazon Web Services EMEA SARL (Reserve)
- Place of business: Luxembourg (38 avenue John F. Kennedy, L-1855 Luxembourg)
- Service and data: reserve for sending the e-mails to your guests (Amazon Simple Email Service), used only if Mailjet drops out unforeseeably (DPA § 5 para. 2); it then receives the same data as Mailjet.
- Place of processing: EU (Frankfurt region); access from the USA is possible, safeguarded by the EU-US Data Privacy Framework and EU standard contractual clauses (as with Mailjet).
History of changes
- 19 October 2026: list published — Hetzner Online GmbH and Mailjet.
- 29 October 2026: reserve for sending guest e-mails added: Amazon Web Services EMEA SARL (Amazon SES, Frankfurt region) — used only if Mailjet drops out unforeseeably.