Subprocessors
The providers NinetoSix GmbH engages to operate Dropable.
- Version:
- 2026-08-15
- In force since:
- 2026-08-15
- Last updated:
- 2026-08-15
We operate Dropable using the providers listed below. Each is bound by a data processing agreement and processes personal data only for the purpose stated.
This page is the list referred to in our data processing agreement at https://dropable.io/dpa.
1. How changes are announced
We inform customers at least 30 days before adding or replacing a subprocessor. Notice is sent to the workspace owner and administrators.
You may object to a change on reasonable data protection grounds within that period. The objection procedure and its consequences are set out in the subprocessor section of the data processing agreement.
2. What the transfer basis column means
- EU/EEA
- Processing takes place within the European Union or the European Economic Area. No transfer mechanism is required.
- Data Privacy Framework
- The provider is certified under the EU-US Data Privacy Framework, an adequacy decision of the European Commission.
- Standard contractual clauses
- Transfer on the basis of the European Commission's standard contractual clauses under Article 46(2)(c) GDPR, together with supplementary measures.
3. Current subprocessors
| Provider | Legal entity | Purpose | Processing location | Transfer basis |
|---|---|---|---|---|
| Supabase | Supabase, Inc. | Database, authentication and file storage | European Union | EU/EEA |
| Vercel | Vercel, Inc. | Application hosting and content delivery | European Union and United States | Data Privacy Framework |
| Cloudflare | Cloudflare, Inc. | Video processing and delivery | Global content delivery network | Standard contractual clauses |
| Stripe | Stripe Payments Europe, Ltd. | Payment processing and invoicing | European Union and United States | Data Privacy Framework |
| Resend | Resend, Inc. | Delivery of transactional email | European Union and United States | Data Privacy Framework |