Subprocessors and other recipients
Last updated: 3 October 2026
Subprocessors
Providers that process personal data from Customers' Linear workspaces on BackupLatte's behalf, under the DPA. We give at least 30 days' notice before adding or replacing one (see the DPA, section 5).
| Provider | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH (Germany) | Server running the API, background jobs, database and queue | All account data, encrypted Linear tokens, backup data while it is processed | Falkenstein, Germany | EU — none needed |
| Cloudflare, Inc. (USA) | Website and app delivery, network proxy and tunnel, DDoS protection; R2 storage for backups and database copies | Request data (IP address, headers, request content in transit); stored backups and database copies | R2 storage: EU jurisdiction. Network: global | Cloudflare's customer DPA: EU SCCs, UK Addendum, EU–US Data Privacy Framework |
Our other processors
Providers that process personal data for which BackupLatte itself is the controller — support correspondence, alert emails to account holders and website analytics — on our instructions (see the Privacy Policy). Hetzner and Cloudflare above also process our account data in the same way.
| Provider | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Zoho Mail (Zoho, EU data centre) | Business email for support and legal requests | Emails you send us and our replies | EU (zoho.eu) | Zoho's data processing addendum has been requested and is not yet signed |
| Resend (Plus Five Five, Inc.) (USA) | Sending backup alert emails from backuplatte.com | Your email address, the workspace name, the backup's status and reason | USA | Resend's DPA (part of its terms): EU Standard Contractual Clauses and the EU–US Data Privacy Framework |
| Google Ireland Limited (Ireland), with Google LLC (USA) | Google Analytics on the landing page and the blog, only after the visitor accepts | Pages viewed, referrer, device and browser type, country and region, analytics cookie identifiers | EU and USA | Google's data processing terms, with the EU Standard Contractual Clauses; Google LLC is certified under the EU–US Data Privacy Framework |
Independent controllers
| Provider | Role |
|---|---|
| Paddle | Merchant of Record for all purchases. Paddle decides how it processes checkout and payment data, under its own privacy notice. The Paddle entity you contract with depends on your location (see Paddle's Buyer Terms). |
Services you connect
| Service | Role |
|---|---|
| Linear | Your own Linear workspace, which you connect. We read from it for backups and write to it only for restores you start. Your agreement with Linear governs Linear's processing. |