Infrastructure providers and subprocessors
Last updated: November 1, 2026
Hosting, network security, email, and payment providers; roles and public data processing terms.
1. Providers and scope of use
This directory explains infrastructure used by CBBDigital LLC (Finland — Hetzner Online GmbH; US — Cloudflare, Meta, Google, Stripe). Merchants control their appointment/staff data and we process it on instructions. We may be a separate controller for our own account, billing, support and security purposes. Company country, server location and countries from which data may be accessed are different concepts. If your business is established in Türkiye (TR): Cross-border data processing and transfers via Finland (Hetzner) and the US (Cloudflare, Meta, Google, Stripe) rely on Turkish Personal Data Protection Law No. 6698 Article 9 (KVKK Madde 9 — explicit consent obtained by the salon for end-customers, or occasional/contract-performance exceptions and standard contractual safeguards under KVKK Art. 9).
Hetzner Online GmbH
- Purpose
- Server hosting and infrastructure
- Role
- Processor for our own data; subprocessor for merchant data processed on instructions
- Location
- Contracting company: Germany; selected server: Helsinki, Finland. This does not locate every other provider or remote access in Finland.
- Use
- Core hosting
Cloudflare, Inc.
- Purpose
- CDN, reverse proxy, WAF, DDoS protection and Tunnel
- Role
- Processor/subprocessor for covered service data; other roles depend on the activity and applicable terms
- Location
- United States company; global network. No EU-only processing promise.
- Use
- Website and network security
Google LLC — Google Workspace
- Purpose
- Business email and SMTP relay for account, support and configured notifications
- Role
- Processor/subprocessor for email content on instructions; other service/account data depend on Google's terms
- Location
- United States contracting company; processing and transfers under Workspace terms. No exclusive regional storage promise.
- Use
- Business email; customer notifications only when enabled
Stripe — entity named in the account agreement
- Purpose
- CBBDigital B2B subscription checkout, invoicing and payment security
- Role
- Processor for relevant instructed services; independent controller for fraud prevention, KYC/AML and other own statutory purposes
- Location
- Entity, locations and transfers depend on the applicable Stripe account agreement and service
- Use
- Processes B2B subscription and service checkout payments via Stripe Hosted Checkout (pay.cbbdigital.us) according to the accepted order snapshot.
2. Optional connections
Meta/WhatsApp Cloud API and Google Calendar API are used only when separately configured and enabled for the merchant. Listing them does not mean a connection is active. Calendar API access is not assumed to be covered by the Workspace email CDPA for every API use. Purpose, scope and transfer requirements (KVKK Article 9 and Law No. 6563 / İYS for Türkiye; GDPR Chapter V / UK GDPR / FADP for EU/EEA/UK/CH) are assessed for the enabled channel.
3. Documents, changes and transfer safeguards
The applicable data-processing terms accepted through the Hetzner, Cloudflare, Google Workspace and Stripe account processes are retained in a restricted archive. Public DPA links describe provider terms; private acceptance records, signed copies and confidential audits are not published. A provider DPA alone does not complete our merchant contract or any required international transfer instrument. If your business is established in Türkiye (TR): The legal basis for cross-border transfers to Finland (Hetzner) and the US (Cloudflare, Meta, Google, Stripe) is Turkish Personal Data Protection Law No. 6698 Article 9 (KVKK Madde 9 — explicit consent obtained by the salon for end-customers via layered disclosure or occasional/contract-performance exceptions and standard contractual safeguards under KVKK Art. 9). If your business is established in the EU/EEA, United Kingdom or Switzerland: Cross-border transfers are governed by GDPR Chapter V (SCC Module 2 / DPF), UK GDPR (IDTA / UK Addendum) and Swiss FADP Art. 16/17 safeguards. Prior notice and objections for new or changed subprocessors follow the signed merchant agreement; updating this page does not replace required notice. Accepted contract copies are preserved. Information and requests: info@cbbdigital.us.
providers-2026-11-01-v2