Sub-processors

Version: 30 September 2026
Last change to the list: 30 September 2026

S1. What this page is

S1.1 GIJA HUB MB ("we") uses other companies to help provide the Service. This page lists them. It is part of our Data Processing Agreement (DPA).

S1.2 Two groups of providers appear here:

• Part A: sub-processors that handle Customer Content (your drone images and results) for you. We are your processor, and they are our sub-processors.
• Part B: providers that help us with our own account, email and website data. We are the controller of that data.

S1.3 Providers that are independent controllers (Stripe and Google Sign-In) are listed separately in S3. They are not our sub-processors.

S1.4 Each provider is bound by a written contract with data protection duties at least as strict as our DPA. We stay responsible to you for our sub-processors.

S2. Sub-processors

Part A: Customer Content

S2.1 "Possible" and "Planned" providers are listed now so that you can see them in advance. We give 30 days' notice (clause S4) before we first use one of them for your Customer Content.

S2.2 Data that each provider handles in Part A: uploaded images and their metadata, results, and the files behind share links and galleries (Hetzner, Google Cloud, OVH, Contabo); the email address and the email content, including result links (Brevo).

Part B: our own account, email and website data

S2.3 Umami's contract includes the EU Standard Contractual Clauses for transfers to the United States. The analytics data is cookieless, aggregated and pseudonymised. We rely on legitimate interest for it (see the Privacy Policy).

S3. Providers that are not our sub-processors

S3.1 Stripe (independent controller). Stripe takes payments for balance purchases as merchant of record (see Terms clause 6.1). Stripe decides how it uses the payment data for payments, tax and fraud prevention, under its own privacy notice. It does not receive Customer Content. Entities: Sold through Link, LLC (USA) and other Stripe group companies, including Stripe Technology Europe, Limited (Ireland).

S3.2 Google Sign-In (independent controller). If you choose Google Sign-In, Google authenticates you under its own privacy policy. We receive your email address and Google account ID. Entity for users in the EEA: Google Ireland Limited. Google receives no Customer Content.

S3.3 Our own equipment. For custom jobs that you approve, we may use a server located in our own office premises in the EU. This is our own equipment. It is not a sub-processor. We describe its security in Annex II of the DPA.

S4. Changes and objections

S4.1 Notice. We tell you about a new sub-processor, or a replacement of one, at least 30 days before it starts to handle Customer Content. We send an email to your account address and we update this page with the new version date.

S4.2 What the notice says. The name and entity of the provider, its country, what it does, and the date it starts.

S4.3 Objection. You may object in writing to agne@gijahub.com, with reasons related to data protection, within 14 days after our notice.

S4.4 Solving it. We try in good faith to solve your objection, for example by not using the new provider for your data.

S4.5 If it is not solved. If we cannot solve the objection within the 30-day notice period, you may end the contract for the affected service by written notice. We then refund your unused Paid Balance for the affected service, through Stripe, as described in Terms clauses 7.2 and 16.3. If we cannot provide the Service without the new provider, the affected service is the whole Service.

S4.6 We do not use the new provider for your Customer Content until the objection is solved or the contract has ended, unless you agree.

S4.7 Urgent replacement. If a provider fails or a security risk needs an immediate replacement, we may act with shorter notice. We tell you as soon as we can, and your right to object stays.

S4.8 Not covered. A change of Stripe or of Google Sign-In is not a sub-processor change. They are independent controllers. Their terms and privacy notices apply.

S5. Where your data is

S5.1 All Customer Content is stored and processed in the EU: on servers of Hetzner in Germany and Finland, on temporary servers of Google Cloud in Finland, Belgium and the Netherlands, and, if used, servers of OVH in France, of Contabo in Germany, and on our own equipment in our office premises in the EU.

S5.2 We do not transfer Customer Content outside the EU. We handle legal requests as described in Terms clause 12.6.

S6. Version history

Previous versions of this page are available on request at agne@gijahub.com.