Introduction
Pursuant to Article 28(2) of the General Data Protection Regulation (GDPR), Zenboek informs its customers of the sub-processors engaged in the processing of personal data.
This list is publicly available and kept up to date. Changes are announced at least 30 days in advance by email and on this page. Customers have the right to object to new sub-processors in accordance with their Data Processing Agreement with Zenboek.
Questions or comments? Contact us at privacy@zenboek.com.
Current sub-processors
Hosting & Infrastructure
| Name | Country | Purpose | GDPR basis | Privacy policy |
|---|---|---|---|---|
| Hetzner Online GmbH | Germany (EU) / Finland (EU) | Server hosting, databases and storage of all customer data | GDPR Art. 28 DPA - data stays in EU | hetzner.com |
Open Banking
| Name | Country | Purpose | GDPR basis | Privacy policy |
|---|---|---|---|---|
| Ibanity NV (Ponto Connect) | Belgium (EU) | PSD2 Account Information Service - fetching bank statements and transaction data for automated bookkeeping | GDPR Art. 28 DPA - data in EU; only active after explicit user consent | ibanity.com/privacy-policy |
Payment processing
| Name | Country | Purpose | GDPR basis | Privacy policy |
|---|---|---|---|---|
| Mollie B.V. | Netherlands (EU) | Processing online payments (iDEAL, credit card, SEPA, etc.) for customer invoices | GDPR Art. 28 DPA - data in EU | mollie.com |
| SumUp Limited | Ireland (EU) | Card payments on a SumUp card terminal (Solo) from the point-of-sale module: amount, description and transaction status. Only active when the company connects SumUp itself; card data never reaches Zenboek. | GDPR Art. 28 DPA - data in EU; only active once connected by the customer | sumup.com |
| CCV Group B.V. | Netherlands (EU) | Card payments on a CCV card terminal from the point-of-sale module: amount, description, terminal details and transaction status. Only active when the company connects CCV itself; card data never reaches Zenboek. | GDPR Art. 28 DPA - data in EU; only active once connected by the customer | ccv.eu |
AI processing
AI features are optional. Data from a company's administration is only sent to an AI provider after that company has given consent (during onboarding or via Settings → AI Autopilot) and a user uses an AI feature; automatic AI features additionally require their own toggle. Without consent, or after withdrawal via Settings → AI Autopilot, no data from the administration is shared with AI providers. The data an AI feature needs is not anonymised for that purpose; see the privacy policy (section 5b) for the categories of data.
| Name | Country | Purpose | GDPR basis | Privacy policy |
|---|---|---|---|---|
| Google LLC (Gemini API) | United States | AI categorisation, text generation, accounting analysis, answers to questions about CRM data | EU-US Data Privacy Framework, SCCs as fallback (Google data processing addendum) | policies.google.com |
| OpenAI, L.L.C. | United States | AI assistance, document processing (fallback provider), audio processing and speech transcription | SCCs + EU Data Processing Addendum | openai.com |
| Anthropic PBC | United States | Alternative AI provider for text generation | SCCs | anthropic.com |
| Cohere Inc. | United States / Canada | Document reranking for search results | SCCs | cohere.com |
| Google LLC (Cloud Vision API) | United States | OCR processing of invoice images | SCCs + EU Data Processing Addendum | policies.google.com |
Video and audio calls
Demo and customer calls run through a LiveKit media server that Zenboek operates itself on its own infrastructure (livekit.zenboek.com). The open-source LiveKit software runs on our own servers and any recordings are written to local storage there; audio, video and recordings are not passed on to LiveKit Inc. or any other third party. The processing therefore falls entirely under the hosting sub-processor listed above.
| Name | Country | Purpose | GDPR basis | Privacy policy |
|---|---|---|---|---|
| LiveKit media server (self-hosted at Hetzner Online GmbH) | Germany (EU) | Real-time processing of audio, video and screen sharing during demo and customer calls, and recording of a call when a participant chooses to do so. Data processed: audio and video stream, shared screen, the participant name entered and the participant IP address | No transfer to an external provider: processing takes place on servers operated by Zenboek itself. The underlying hosting falls under the GDPR Art. 28 DPA with Hetzner - data stays in the EU | hetzner.com |
Email (transactional)
| Name | Country | Purpose | GDPR basis | Privacy policy |
|---|---|---|---|---|
| Mailgun Technologies, Inc. | United States (EU region available) | Sending transactional emails (invoices, notifications, password resets) | SCCs - EU region delivery | mailgun.com |
Push notifications
| Name | Country | Purpose | GDPR basis | Privacy policy |
|---|---|---|---|---|
| Expo (mobile app) | United States | Delivering push notifications to mobile devices | SCCs | expo.dev/privacy |
Website and product analytics
Google Analytics is only loaded after you have explicitly consented to analytics via the cookie banner. Without that consent the script is not loaded and nothing is recorded in your browser. Google Analytics runs on the production environment only and with IP anonymisation enabled. Our own website measurement for conversion optimisation runs entirely on our own servers, without a sub-processor; see the privacy policy for what it does and does not record.
| Name | Country | Purpose | GDPR basis | Privacy policy |
|---|---|---|---|---|
| Google LLC (Google Analytics 4) | United States | Anonymised usage research on the public website: page views, traffic sources and coarse device and country data. Data processed: truncated IP address (IP anonymisation enabled), user agent, pages visited and a pseudonymous cookie ID | Consent (GDPR Art. 6(1)(a)); EU-U.S. Data Privacy Framework (adequacy decision) supplemented by SCCs | policies.google.com |
Visitor statistics (IP location)
For our own visitor statistics we translate a website visitor IP address into an approximate location and, for a business internet connection, an organisation name. That lookup is performed by IPinfo and only happens after you have consented to analytics via the cookie banner. Only the IP address is sent, never account, bookkeeping or contact data; local and internal IP addresses are skipped.
| Name | Country | Purpose | GDPR basis | Privacy policy |
|---|---|---|---|---|
| IPinfo Inc. | United States | Looking up country, city, approximate coordinates and organisation name for a website visitor IP address. Data processed: the visitor IP address | Consent (GDPR Art. 6(1)(a)); SCCs under the IPinfo Data Processing Agreement (GDPR Art. 46(2)(c)) | ipinfo.io/privacy-policy |
Address service: PDOK
For Dutch address suggestions we use the PDOK Locatieserver. Only the address search term, postal code and house number or the selected public address ID are passed to this service through our server. Account data and other form data are not sent. Manual entry remains possible.
Public source: RDW Open Data (not a sub-processor)
In the workshop and used-car sales modules a car business can retrieve vehicle details from RDW Open Data, the public dataset of the Dutch Vehicle Authority (Rijksdienst voor het Wegverkeer). Only the license plate is passed on through our server; name, address and other customer data are not. The RDW does not process personal data on behalf of Zenboek in this respect and is therefore not a sub-processor. Manual entry remains possible.
Platforms you connect yourself: Shopify, WooCommerce and bol.com (not sub-processors)
When you connect your own web shop or seller account, Zenboek retrieves data from that platform on your instructions: orders with customer name, email address, address and amounts from Shopify or your WooCommerce web shop, and the invoices and settlements from bol.com. These platforms process this data under your own agreement with them, not on behalf of Zenboek, and are therefore not sub-processors of Zenboek. A WooCommerce web shop runs on your own website. Zenboek stores the access keys encrypted, only reads, and sends no customer data back to the platform. Disconnecting deletes the keys; records already imported are kept.
Web fonts
Web fonts are fetched by your browser directly from the font service, which therefore sees your IP address. The application and the website use Bunny Fonts in the EU for this. Only on public forms and white-label vacancy pages, where the customer can select a Google font themselves, is the font fetched from Google Fonts.
| Name | Country | Purpose | GDPR basis | Privacy policy |
|---|---|---|---|---|
| BunnyWay d.o.o. (Bunny Fonts) | Slovenia (EU) | Serving the web font of the application and the website on every page view. Data processed: IP address and user agent of your browser. Bunny Fonts states that it operates a zero-tracking and no-logging policy | GDPR Art. 28 DPA - data in EU | bunny.net/privacy |
| Google LLC (Google Fonts) | United States | Serving the font selected by the customer on public forms and white-label vacancy pages. Data processed: IP address and user agent of the visitor to those pages. The rest of the application loads nothing from Google Fonts | EU-U.S. Data Privacy Framework (adequacy decision) supplemented by SCCs | policies.google.com |
LinkedIn outreach (B2B marketing)
Zenboek actively reaches out to business contacts via LinkedIn for its own lead generation (legitimate interest, GDPR Art. 6(1)(f)). This does not involve data of Zenboek customers, but of business prospects outside Zenboek.
| Name | Country | Purpose | GDPR basis | Privacy policy |
|---|---|---|---|---|
| Unipile SAS | France (EU) | Sending LinkedIn connection requests and messages, retrieving public LinkedIn profile data | GDPR Art. 28 DPA - data in EU | unipile.com/privacy-policy |
Changes
Zenboek reserves the right to add, modify or remove sub-processors. In accordance with GDPR Article 28(2), you will be informed of any changes at least 30 days in advance by email.
You have the right to object to the engagement of new sub-processors. Please contact us at privacy@zenboek.com.
Contact details
Softply (trading name: Zenboek)
Meerring 34, 5658LD Eindhoven, the Netherlands
CoC: 95773428 • VAT: NL005173326B42
Tel: +31 6 23630807
Email: privacy@zenboek.com
This page does not replace the Data Processing Agreement (GDPR Art. 28), which is available separately via privacy@zenboek.com.