Právní dokumenty

Právní dokumenty > Evropská unie

Subprocessor List

Last updated: 10 June 2026

This page contains the current list of third-party providers (subprocessors) engaged by NEXON Systems Sp. z o.o. for the provision of the NEXON Vision service, who may process personal data of Customers on behalf of NEXON.

This page forms part of the Data Processing Agreement (DPA) and the Privacy Policy.

1. General Information

1.1. NEXON engages subprocessors to provide infrastructure, integrations, notifications, analytics, and other technical functions necessary for the operation of the Service.

1.2. Each subprocessor is bound by a data processing agreement with NEXON containing data protection obligations substantially equivalent to those of our DPA.

1.3. The list on this page is current as of the date of last update. In case of discrepancies between this page and the list provided in the DPA, the list on this page is authoritative.

2. Current List of Subprocessors

2.1. Infrastructure and Storage

Provider Purpose Place of processing Transfer mechanism
DigitalOcean, LLC Hosting, servers, core Service infrastructure and content storage EU (Germany) Processing within the EU
Cloudflare, Inc. CDN, caching, reverse proxy, DDoS protection (global server network) EU / US Processing within the EU / SCC

2.2. Analytics and Consent

Provider Purpose Place of processing Transfer mechanism
Google LLC (Google Analytics 4) Website visitor analytics United States SCC + EU-US Data Privacy Framework
Google LLC (Google Sign-In) User authentication via Google United States SCC + EU-US Data Privacy Framework
Usercentrics A/S (Cookiebot) Cookie consent management EU (Denmark) Processing within the EU

2.3. Payments

Provider Purpose Place of processing Transfer mechanism
Stripe Payments Europe Ltd Payment processing for Customers EU (Ireland) Processing within the EU

2.4. Notifications

Provider Purpose Place of processing Transfer mechanism
SendPulse Inc. Transactional email notifications (confirmations, security, billing) EU (Germany) / US Processing within the EU / SCC

2.5. Support and Communications

Provider Purpose Place of processing Transfer mechanism
Crisp IM SAS Live-chat, helpdesk, and AI-powered technical support assistant (Hugo.ai) EU (Netherlands, Germany) Processing within the EU

2.6. Customer-Activated Integrations

Provider Purpose Place of processing Transfer mechanism
Canva Pty Ltd Design creation and asset import (Customer-activated) United States SCC

3. Explanation of Transfer Mechanisms

  • Processing within the EU — data does not leave the European Economic Area. No additional transfer mechanisms are required.
  • SCC (Standard Contractual Clauses) — Standard Contractual Clauses approved by the European Commission for data transfers to third countries. The most common mechanism for transfers outside the EEA.
  • EU-US Data Privacy Framework — a framework agreement between the EU and the United States recognising adequate data protection in certified US companies (in particular, Google).
  • Combined processing (EU/US) — certain providers (in particular, notification services) process data both within the EU and outside the EEA. SCC apply for transfers outside the EEA.

4. How We Select Subprocessors

When engaging a new subprocessor, NEXON evaluates:

  • availability of a DPA compliant with GDPR requirements;
  • technical and organisational security measures of the provider;
  • certifications (ISO 27001, SOC 2, etc.) where available;
  • place of data processing and cross-border transfer mechanisms;
  • reputation and financial stability of the provider.

5. Changes to the List

5.1. NEXON may add, replace, or remove subprocessors to ensure the operation of the Service.

5.2. Changes are reflected on this page with the date of update.

5.3. For material changes (in particular, addition of a new subprocessor with access to significant volumes of personal data, or change of processing location), we aim to notify Customers through the Service or email at least 14 calendar days before the changes take effect.

5.4. Certain categories of Customers (such as retail chains and regulated clients) may agree with NEXON in a separate written agreement an individual procedure for subprocessor notifications and the right to reasonably object to specific subprocessors.

6. Right to Object

6.1. The Customer may reasonably object to a specific subprocessor if it considers that the engagement creates unacceptable risks to the protection of personal data.

6.2. The objection is sent to [email protected] with: - name of the subprocessor; - justification of the objection; - desired outcome.

6.3. NEXON shall consider the objection within a reasonable time and propose one of the following resolutions: an alternative processing arrangement, limitation of functionality, or, if no alternative is possible, the right of the Customer to terminate the use of the Service with payment only for the Services actually provided up to the termination date.

7. Language

This page is published in English. NEXON may publish translations into other languages for convenience. In case of any discrepancy between the English version and any translation, the English version prevails.

Contact for subprocessor questions: [email protected]