Subprocessors and Recipients
Version: v2026.10.09 Effective from: 2026-10-09 Provider: Paul Bengart, Keplerstraße 4A, 39104 Magdeburg, Germany
This list is Annex 2 to the Data Processing Agreement and is referred to in Section 10 of the Terms of Service. It distinguishes three groups of recipients: sub-processors that process data on behalf of the Provider (section 1); independent controllers that process data under their own responsibility (section 2); and participant-facing third parties that receive data only after a click by the participant (section 3). Polar Software, Inc. is listed in section 1 and has a dual role: processor for account, checkout and subscription data and, at the same time, as Merchant of Record an independent controller for the sale of the plans. Google Ireland Limited is listed in section 1 as processor for reach measurement on the marketing pages of the website; it receives no study, response or account data for this. Google is also listed in section 2 as an independent controller for sign-in with Google. The Google Sheets connection is listed separately in section 4: for it, Google is a recipient chosen by the Customer and not a sub-processor of the Provider. Processors that process only data for which the Provider itself is the controller (website reach measurement, account and billing data) are listed here for completeness; the Privacy Policy applies to them.
1 Sub-processors (Article 28 GDPR)
| Recipient | Service | Data categories | Location / region | Transfer basis |
|---|---|---|---|---|
| netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany (Local Court of Mannheim, HRB 705547) | Application hosting and file storage: operation of the application server; storage of project data, designs, uploads, responses including the file-based backup copy, exports, application logs and the Provider's own backups (database backups and project files) | All data processed via the platform while being processed in the server's memory; stored persistently: project and study content, response data and response metadata, exports, server and application logs and, in the database backups, all contents of the database, including account, audit, contract and billing data | Data centre Nuremberg, Germany | EU hosting, no third-country transfer |
| Ubicloud B.V., Turfschip 267, 1186 XK Amstelveen, Netherlands (contracting party for Customers in the European Economic Area; payee Ubicloud Inc., USA) | Managed PostgreSQL database for accounts, workspaces, projects, responses, audit events, contract records, order data from Polar and the usage statistics of the application; point-in-time recovery of the database | Account data, project metadata, response data and response metadata, audit and security events, contract records, order data from Polar and results of the reconciliation with Polar, error reports, usage data of the application (account identifier, time, function used, no longer than 90 days) | Data centre Frankfurt am Main, Germany; contracting party in the European Economic Area; parent company in the USA, remote access by the database provider's support from the USA possible | EU contracting party; for any access from the USA, the database provider's intra-group standard contractual clauses (clause 6.1 of its data processing agreement) |
| coolLabs Solutions Kft., Hungary (operator of Coolify Cloud) | Deployment control: deployment and updating of the application with administrative access to the application server; no intended processing of content or response data takes place | Configuration data and container logs; within the administrative access, the data stored on the application server | Hungary (EU); control infrastructure in the EU as stated by the recipient | EU, no third-country transfer |
| Greenmark IT GmbH (do.de), Leinstraße 3, 31061 Alfeld (Leine), Germany | Transactional e-mails (verification of the e-mail address, password reset, account notices, contract confirmations, notifications under the data processing agreement), delivery of messages from the contact form, operation of the mailboxes info@, privacy@, security@ and abuse@ | E-mail addresses, names, contents and metadata of e-mails, contents of contact enquiries and support communication | Germany | EU hosting, no third-country transfer |
| Polar Software, Inc., 548 Market Street PMB 61301, San Francisco, CA 94104-5401, USA (registered address 3500 South DuPont Highway, Dover, DE 19901, USA) | Account, checkout and subscription data for providing the paid plans: linking of account and subscription, subscription status, customer e-mail, carrying out cancellations and deleting the customer on the Provider's instruction; the Provider receives from Polar the subscription ID, plan, status, end of the billing period, customer identifier and e-mail address and, for each order, the order and invoice number, reason, status, amounts with currency, times of order and payment and the identifiers of checkout and product. No study or response data | Account data (e-mail address, account identifier), billing metadata (subscription ID, plan, status, end of the billing period, classification as consumer or business customer, organisation name), order data (order and invoice number, reason, status, amounts, times, identifiers of customer, checkout and product) | USA; Polar's sub-processors at https://polar.sh/legal/sub-processors | EU Standard Contractual Clauses (Module 2) in accordance with the Polar Data Processing Addendum |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Reach measurement on the marketing pages of the website (Google Analytics 4), only after the visitor's consent in the cookie banner; not in the application and not in surveys. No study, response or account data; Google Signals, ad personalisation and the data sharing with Google products and services are switched off; event and user data is deleted at Google after 14 months | Cookie identifier, device and browser details including device model, browser identification and screen resolution, pages visited without query parameters except campaign parameters, referring page (origin of the referring page only), clicks on buttons and pricing plans, opened FAQ questions, scroll events, outbound clicks, start of the demo video (event demo_video_play), approximate location down to the city; the IP address is used for this and discarded before storage | Ireland; processing also by Google LLC, USA | EU-US Data Privacy Framework (Google LLC certified); as a fallback EU Standard Contractual Clauses under the Google Ads Data Processing Terms |
For the database at Ubicloud, special categories of personal data under Article 9 GDPR and protected health information within the meaning of HIPAA are excluded from processing (Section 3(2) of the Data Processing Agreement).
Sub-processors of the service providers. netcup uses companies of the Anexia group (Austria and Germany) as sub-processors. Ubicloud's sub-processors are published at https://www.ubicloud.com/docs/about/sub-processors.
Dual role of Polar. Polar is at the same time the Merchant of Record and an independent controller for the sale of the plans in its own name, payment processing (via Stripe), invoicing with tax statement, taxes and refunds; the Polar Buyer Terms (https://polar.sh/legal/checkout-buyer-terms) and the Polar Privacy Policy (https://polar.sh/legal/privacy) apply to this. The Provider does not receive payment instrument data (in particular card data). For the data processed as processor, Polar notifies personal data breaches under the Polar Data Processing Addendum within 72 hours.
2 Independent Controllers
These recipients process personal data under their own responsibility under Article 4(7) GDPR. They are not sub-processors; their own privacy notices apply to their processing. The legal bases for the transfers are described in the Privacy Policy.
| Recipient | Role and service | Data categories | Location | Transfer basis | Contractual basis |
|---|---|---|---|---|---|
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Sign-in with Google (OAuth 2.0 / OpenID Connect), only if the user chooses this sign-in method | E-mail address, account ID, display name | Ireland | In accordance with the safeguards published by the recipient (adequacy decision or standard contractual clauses), see its privacy policy | Google Privacy Policy |
| Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland | Sign-in with Microsoft (OAuth 2.0 / OpenID Connect), only if the user chooses this sign-in method | E-mail address, account ID, display name | Ireland | In accordance with the safeguards published by the recipient (adequacy decision or standard contractual clauses), see its privacy statement | Microsoft Privacy Statement |
3 Participant-Facing Third Parties after a Click
A Customer may embed videos from YouTube or Vimeo in a survey. When the survey page is loaded, no connection to the video provider is established; the participant sees a local placeholder with a notice. Only when the participant starts playback by clicking does the participant's browser retrieve the video from the provider. The video provider then receives the participant's IP address and browser details as well as playback data; survey responses are not transmitted. The Customer decides on the embedding and informs the participants in its privacy notice.
| Recipient | Service | Data categories | Location | Transfer basis | Trigger |
|---|---|---|---|---|---|
| YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) | Video playback via youtube-nocookie.com | IP address, browser details, playback data | Ireland / worldwide | In accordance with the safeguards published by the recipient (adequacy decision or standard contractual clauses), see its privacy policy | Only after a click by the participant |
| Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA | Video playback with the Do Not Track parameter enabled (dnt=1) | IP address, browser details, playback data | USA | EU-US Data Privacy Framework (certified; as of the Vimeo Privacy Policy dated 2025-09-19) and EU Standard Contractual Clauses | Only after a click by the participant |
4 Recipients Chosen by the Customer; No Further Recipients
On the Customer's instruction, the Provider transfers data to recipients that the Customer chooses itself. These recipients are not sub-processors of the Provider; they act under the Customer's agreement with them. Whether the transfer is lawful, including any transfer to third countries under the recipient's terms, is the Customer's responsibility as controller.
| Recipient | Service | Data categories | Location | Basis | Trigger |
|---|---|---|---|---|---|
| Google as the provider of the Google account that the user chooses (a private Google account or Google Workspace) | Google Sheets connection (optional, only in plans that include this function): the Provider creates a spreadsheet in the Customer's Google Drive and updates it about every hour; the connection uses drive.file and updates only the spreadsheet it creates itself. This permission also allows explicitly selected files, which this connection does not offer. The Provider does not delete the spreadsheet; it stays under the Customer's control |
The project's responses as in the wide response export (all responses including incomplete ones, participant identifiers, panel IDs where collected, free-text answers, timestamps and system details), optionally with the codebook | according to Google's terms for the chosen Google account | Customer's instruction (Article 28(3)(a) GDPR); the Customer's agreement with Google | Only when a user with export rights connects the project and confirms the transfer to the Google account shown |
For the account data of the connecting person (Google identifier, e-mail address, refresh token stored in encrypted form), the Provider itself is the controller; details are set out in the Privacy Policy.
Beyond this, no recipients to which the Provider transfers personal data are currently engaged. Google Analytics 4 (section 1) runs only on the marketing pages of the website after the visitor's consent, not in the application and not in surveys. The Provider evaluates the usage statistics of the application itself in the database at Ubicloud; no analytics service provider is involved.
5 Change Process
(1) Review. This list is reviewed regularly and upon changes to the service providers engaged.
(2) Announcement. The Provider informs the workspace owners in advance of the intended engagement or replacement of a sub-processor by e-mail to the address on file in the account as soon as it becomes aware of the change, as a rule at least 14 days before it takes effect, and records the change in the change history (section 7). If a change is required without delay, the Provider informs them subsequently (Section 8(2) of the Data Processing Agreement).
(3) Objection. Customers may object within 14 days of receipt of the notice on data protection grounds in text form (for example by e-mail) to privacy@choicery.ai. If the parties do not reach agreement, either party may terminate the contract with effect from the time the change takes effect (Section 8(3) of the Data Processing Agreement). The winding-up is governed by the Data Act Exit and Switching Policy.
(4) Removal. The removal of a sub-processor or a recipient is documented in the change history and does not require advance notice.
(5) Independent controllers and participant-facing providers. Changes in sections 2 and 3 are documented in the change history and updated accordingly in the Privacy Policy.
6 Location and Jurisdiction of the Infrastructure
This information is provided under Article 28 of Regulation (EU) 2023/2854 (Data Act) on the jurisdiction to which the infrastructure used for data processing is subject.
| Service provider | Country of the data centres | Country of the contracting party's seat | Jurisdictions to which the infrastructure is subject |
|---|---|---|---|
| netcup GmbH | Germany (data centre Nuremberg) | Germany | German law and Union law |
| Ubicloud B.V. | Germany (Frankfurt am Main) | Netherlands; parent company Ubicloud Inc. in the USA | German law and Union law for the data centre; Dutch law for the contracting party; US law may cover the parent company and its support remote access |
| coolLabs Solutions Kft. | European Union (control infrastructure in the EU as stated by the service provider); the controlled server is located in Germany | Hungary | Hungarian law and Union law |
| Greenmark IT GmbH (do.de) | Germany | Germany | German law and Union law |
Copies of the Provider's own backups are additionally kept on an encrypted external storage medium of the Provider in Germany (German law and Union law).
Measures against access from third countries. Study and response data are stored in the European Union, and the sub-processors that process study or response data have their contractual seat in the European Union. Access to these data from a third country is possible by the database provider's support from the USA; it is safeguarded by the database provider's intra-group standard contractual clauses (clause 6.1 of its data processing agreement). Account, checkout and subscription data are transferred to Polar Software, Inc. in the USA (section 1); Polar does not receive study or response data. For website reach measurement, Google Ireland Limited receives only visitor data of the marketing pages (section 1), no study, response or account data. If the Customer connects a project to Google Sheets, the Provider transfers responses to Google on the Customer's instruction (section 4); this copy is kept outside the Provider's infrastructure, in the Customer's Google Drive. All transmissions are encrypted; credentials and keys are held exclusively by the Provider. The Provider examines requests from authorities or courts of third countries as to their legal basis; disclosure takes place only on the basis of an international agreement or under the conditions of Article 32 Data Act and Article 48 GDPR, limited to the necessary minimum, and the affected Customer is informed insofar as this is legally permitted (Section 10 of the Terms of Service, Section 6(10) of the Data Processing Agreement).
7 Change History
| Date | Change |
|---|---|
| 2026-10-09 | Initial version (v2026.10.09) |
| 2026-10-18 | Section 4: Google Sheets connection added as a recipient chosen by the Customer (not a sub-processor); section 2 (sign-in with Google) unchanged |