Sub-processor list
This page lists the sub-processors engaged by Byte Imagination Roger Zacharczyk to process personal data on behalf of customers under the Data Processing Agreement.
We notify customers at least 30 days before adding or replacing a sub-processor for processor activities under the DPA. Subscribe to sub-processor change notifications by emailing privacy@byteimagination.com with the subject "subprocessor-notify".
| Sub-processor | Role | Data categories | Country of processing | Transfer mechanism |
|---|---|---|---|---|
| Paddle.com Market Ltd | Merchant of Record (payment processing, billing, tax) | Billing data, transaction data, last-4 of card, billing address, VAT id | United Kingdom (with onward transfers as documented in Paddle's DPA) | EU adequacy decision for the United Kingdom (European Commission decision of 19 December 2025, valid until 27 December 2031); EU Standard Contractual Clauses (Module Two) and the UK International Data Transfer Addendum, incorporated in Paddle's Data Processing Agreement, apply as a contractual fallback and govern Paddle's own onward transfers |
| DigitalOcean, LLC | Hosting and infrastructure | All Customer Personal Data at rest and in transit | Germany (Frankfurt / FRA1 region) | Standard Contractual Clauses under DigitalOcean's DPA (provider is US-incorporated; all hosted data physically resides in the FRA1 region in Germany) |
| Resend, Inc. | Transactional email delivery | Recipient email address, sender email address, email subject and body (account verification, password reset, billing notices, service notifications), delivery metadata (bounce / complaint events) | United States | Standard Contractual Clauses (Module Three) under Resend's DPA (emails are routed from Resend's eu-west-1 region in Ireland; all account data and email metadata are stored in the United States) |
| rsync.net, Inc. | Encrypted off-site backup storage | Encrypted copies of all Customer Personal Data, which rsync.net cannot read: they are encrypted on our server with a passphrase that only we hold | United States (Fremont, California) | EU Standard Contractual Clauses incorporated in rsync.net's Data Processing Addendum: Module Three for Customer Personal Data, Module Two for personal data of which we are the controller |
Notes
- Any future analytics or monitoring sub-processor will be added to this list before it is used, subject to the 30-day notice.
- This list is updated as sub-processors are added or replaced. The version and effective date at the top of this document reflect the most recent change.
- Sub-processors engaged only in connection with optional features of a particular Service (for example, an optional feature that calls a third-party API on our behalf to enrich or process data) are disclosed in that Service's Privacy Supplement, where one exists, rather than in the table above. Together with this page, any such Privacy Supplement forms the complete list of Sub-processors for that Service under Section 6 of the DPA.
Reference: Paddle DPA
- Paddle DPA: https://www.paddle.com/legal/data-processing-agreement
- Paddle sub-processors: https://www.paddle.com/legal/sub-processors
Reference: Resend DPA
- Resend DPA: https://resend.com/legal/dpa
- Resend sub-processors: https://resend.com/legal/subprocessors