1. Application
This list describes the providers engaged by Amerged B.V. for the processing set out below. It forms part of the Data Processing Agreement (DPA) to the extent that the provider processes personal data on behalf of a customer. A listing does not mean every provider has access to all data in every project.
For the public website and our own business administration, amerged may itself be the controller and the supplier a processor. That processing is described in the Privacy Notice. A provider contracted directly by the customer does not become our subprocessor merely because of a technical integration; the order establishes responsibilities.
2. Infrastructure, email and billing
| Provider | Service and data | Location and transfers |
|---|---|---|
| Contabo GmbH, Germany | Hosting and infrastructure for agreed customer environments. May include customer files, databases, application data, operational logs and backups, depending on the order. | Standard core hosting for customer services is in Munich, Germany. This storage location is not a general guarantee covering all access by the provider or its further processors. The concluded processing arrangements apply to the selected services; any third-country access must comply with section 4. |
| Cloudflare, Inc., United States | Network protection, security and traffic handling for relevant services. Also edge delivery for the public amerged website. Processing may include IP addresses, request metadata, security events and, for decrypted proxy traffic, request content. | International network, including the EEA and the US; countries and enabled features determine the specific route and access. No general commitment to EU-only processing. The applicable Cloudflare DPA, transfer safeguards and any specifically agreed regional configuration apply. |
| Google — contracted email/cloud mail service | Business email, receipt of contact-form messages and support correspondence. Processes email addresses, message content, any attachments, and delivery and security metadata. Processor for our own correspondence; subprocessor for customer content only where processing through the agreed support channel is permitted. | Google's current entity schedule generally identifies Google Cloud EMEA Limited, Ireland, as the contracting party for Dutch Workspace and Cloud accounts; the actual account agreement governs. Infrastructure and support chains may be worldwide. The applicable Google CDPA, transfer safeguards and regional features actually configured apply. |
| Resend — Plus Five Five, Inc., United States | Delivery of contact-form messages through the ohmyho.st mail gateway operated by amerged to the Google mailbox. Processes sender and recipient details, message content and delivery metadata. For this general form, Resend is a processor for amerged as controller. | US provider with further service providers; no general EU-only restriction on email delivery. The Resend DPA and applicable transfer safeguards apply. |
Cloudflare's website delivery role is separate from the choice of Contabo for core hosting of customer services. ohmyho.st is a service operated by Amerged B.V. itself for the amerged website; it is not a separate external subprocessor here. Cloudflare's external infrastructure role remains relevant.
Billing through Revolut Business. We use Revolut Business for invoices and payment administration. Processing may include contact and billing details, invoice items, payment references and transaction status. Revolut is an independent controller for its own banking, statutory and fraud-prevention purposes. Its Netherlands privacy information identifies Revolut Bank UAB as the primary controller in the EEA; the applicable account terms determine the entity involved and the role for specific billing features. Revolut is not a subprocessor of customer application content merely because we use it for our billing. Its international services may involve transfers outside the EEA.
Support and customer content. Ordinary support email uses Google and is intended for administrative correspondence and problem descriptions. Production data or files containing customer personal data may only be shared through a suitable support channel agreed in advance. Google is used as a subprocessor for such content only where the agreed process and deletion settings support the DPA deadlines. A supplier's general deletion period does not automatically extend our contractual deadlines.
3. Optional AI execution through orq.ai
orq.ai is activated for a customer only where the order includes it. Its public privacy information identifies Orq.AI Holding B.V., the Netherlands as the platform provider. The actual contracting entity is established in the order or accompanying processing register before personal data is processed.
Its function is to orchestrate and manage agreed LLM calls. amerged uses models compliant with the applicable EU AI Act obligations through orq.ai on EU-hosted infrastructure; model execution takes place in the EU. Depending on the configuration, processing may include prompts, context, model responses, user or request identification, usage metadata and execution logs. The order records the EU endpoints and permitted fallback routes within the EU. Support, telemetry and further providers are assessed separately; the commitment about model execution does not automatically make separate email, network or administrative processing EU-only.
Before activation, the order or the accompanying list provided to the customer must identify at least:
- the contracting orq.ai entity and relevant further service providers;
- the selected model providers, models, endpoints and processing regions;
- which personal data may be submitted and whether content is logged;
- retention periods for prompts, responses, telemetry and recovery copies;
- arrangements for model training use and support access;
- permitted fallback routes for model execution within the EU, any additional support or telemetry processing outside the EEA, and the related safeguards.
Unspecified model providers are not approved by this general listing. A change to a new supplier or a materially different processing route is subject to the DPA and the change procedure below. There is no silent fallback to a region that has not been agreed. Without an agreed AI option, this supply chain remains outside the relevant service.
4. Further processors and transfer safeguards
Our suppliers may engage further processors to deliver their services. The relevant chain is assessed against the service actually used and the applicable processing agreement. A link to a supplier's general list does not mean all listed parties process data for every amerged customer and does not grant unrestricted permission for new processing.
Processing outside the EEA requires a valid basis under Chapter V GDPR. This may be an applicable adequacy decision or the European Standard Contractual Clauses with an assessment and supplementary measures where required. The EU–US Data Privacy Framework is used only for an actively certified recipient and processing within the scope of that certification. See our SCC information. A customer agreement for EU-only processing must cover the complete relevant chain, including support, logs and fallback routes.
Relevant supplier information:
- Contabo — information about the processing agreement. The agreement for the services actually selected is concluded through Contabo's customer portal.
- Cloudflare — Data Processing Addendum and further processors.
- orq.ai — privacy information and Trust Center. The agreed processing arrangements and specific model supply chain govern customer content.
- Google — Cloud Data Processing Addendum, contracting entities, Workspace subprocessors and Cloud subprocessors. The service actually used determines which list is relevant.
- Resend — Data Processing Addendum and further processors.
- Revolut Business — Netherlands privacy information.
5. Changes and questions
We inform the customer's designated contractual contact through the agreed channel at least 30 days before engaging a new or replacement subprocessor for the relevant processing. The notice identifies the provider, its activities and relevant locations. The customer may raise a reasoned objection on reasonable data protection grounds during the notice period. The DPA governs the handling of objections and any consequences for the affected service. Updating this webpage alone does not replace the required notice.
Questions may be submitted through our contact form, to the designated contractual contact or to Amerged B.V., attention: Privacy, Op de Smelen 1, 5863 BN Blitterswijck, the Netherlands. The Dutch text is the primary version; the English and German texts are translations. The version above applies both to the webpage and to the PDF generated from the same source.