Sub-processors
for ImmoVision
Last updated: 12 October 2026
This list is Annex 3 to our Data Processing Agreement (DPA). It names the service providers that process personal data on behalf of our customers, with service, purpose, location of processing and basis for transfers outside the EU.
1. General information
We only use sub-processors insofar as this is necessary for hosting, AI functions, media processing, telephony, communication or payment processing.
Each sub-processor is bound by a contract pursuant to Art. 28(4) GDPR which imposes on it essentially the same data protection obligations as our DPA. Under their contractual terms, AI providers may not use customer data to train their models.
Not every third-party provider is a sub-processor. Payment service providers and platform operators such as Meta partly process data under their own responsibility; this is indicated for the respective provider.
2. Sub-processors
Hetzner Online GmbH
Service:
Hosting: servers, database, file storage, backups
Purpose:
Operation of the website, platform, exposés, microsites and mobile app; storage of all customer data and media
Location of processing:
Germany (Industriestr. 25, 91710 Gunzenhausen; data centres in Germany)
Role:
Sub-processor
Third country / basis:
No transfer to third countries.
Google Cloud EMEA Limited (Google Cloud / Vertex AI)
Service:
AI models (Gemini, Gemini Live, Gemini image model, Veo), voice processing
Purpose:
Texts and translations, image editing and virtual staging, video clips, dictation, voice commands, transcription and summarisation, AI assistants (chat and voice), market analyses
Location of processing:
European Union: EU region and the Frankfurt (Germany) and Netherlands regions; contractual partner Google Cloud EMEA Limited, Ireland
Role:
Sub-processor
Third country / basis:
Processing in the EU. For access by group companies in third countries (e.g. support), the adequacy decision on the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses in Google's Cloud Data Processing Addendum apply.
Microsoft Ireland Operations Limited (Azure OpenAI)
Service:
AI text models and real-time voice in an EU region
Purpose:
Alternative to Google for text functions and assistants, where activated by the platform operator
Location of processing:
European Union (Azure region in the EU, e.g. Sweden)
Role:
Sub-processor, where used
Third country / basis:
Processing in the EU (EU Data Boundary). For access from third countries, the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses in the Microsoft Product Terms apply.
Shotstack Pty Ltd
Service:
Video rendering
Purpose:
Assembly of property and social media videos from the images, clips and texts selected for this purpose
Location of processing:
Australia
Role:
Sub-processor
Third country / basis:
Third country without an adequacy decision; transfer on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
Twilio Ireland Limited
Service:
Telephony, call recording, sending of WhatsApp messages
Purpose:
Telephone calls and recording after consent of the other party; transmission of WhatsApp messages — only if the agency sets up Twilio
Location of processing:
USA (processing via api.twilio.com); contracting party Twilio Ireland Limited
Role:
Sub-processor, where set up by the agency
Third country / basis:
USA: EU-U.S. Data Privacy Framework and Twilio's Binding Corporate Rules (BCR).
Voximplant
Service:
Telephony and call recording
Purpose:
Telephone calls and recording after consent of the other party — only if the agency sets up Voximplant instead of Twilio
Location of processing:
in accordance with the data processing agreement with Voximplant
Role:
Sub-processor, where set up by the agency
Third country / basis:
Transfers to third countries only on the basis of the EU Standard Contractual Clauses.
Meta Platforms Ireland Limited
Service:
WhatsApp Business Platform, Instagram, Messenger, lead forms
Purpose:
Receiving and sending messages and enquiries from an agency's customers — only if the agency sets up these channels
Location of processing:
Ireland; group companies in the USA
Role:
Processor for the transmission of messages; independent controller for Meta's own purposes (e.g. security, platform operation)
Third country / basis:
USA: EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses.
3. Services with their own responsibility and services of the agency
3.1 Stripe Payments Europe Limited
Service:
Payment processing for subscriptions and credit, fraud prevention
Role:
Partly processor for payment processing; independent controller for fraud prevention, security and regulatory obligations
3.2 Services that an agency connects via its own contracts
The following services only become active if an agency connects them itself; processing there is governed by the contract between the agency and the service:
- own mailbox and own calendar (Microsoft 365, Google Workspace/Gmail),
- CRM and real estate agent software (e.g. HubSpot, Propstack, onOffice),
- property portals (e.g. via OpenImmo),
- register for commercial electronic communications in Turkey (İYS), providers for electronic invoices and payments in Turkey,
- webhooks and automation services set up by the agency,
- externally embedded 360° tours.
Used without reference to individuals: public map data (OpenStreetMap/Overpass, property coordinates only), exchange rates of the Central Bank of the Republic of Turkey. Push notifications are delivered via the push services of the browser manufacturers (end-to-end encrypted content).
4. Categories of processing by sub-processors
Depending on the booked and activated function, sub-processors may process in particular the following categories of data on our behalf:
- master data
- contact data
- communication data
- property and case data
- user account data
- role and permission data
- appointment and status data
- content from forms, exposés, microsites or CRM entries
- uploaded media and associated metadata
- audio content, transcripts and structured information derived from them, insofar as the corresponding functions are activated
- technical usage and log data, insofar as these serve the provision on behalf of the customer
- conversation content with AI assistants, insofar as the visitors have consented
5. Changes to the sub-processors
We reserve the right to add, replace or technically restructure sub-processors insofar as this is necessary for the provision of services, security, scaling or further development of ImmoVision.
We inform our customers of intended changes in advance in text form (e.g. by e-mail to the agency management and by updating this page). Customers may object within 14 days for good cause under data protection law (clause 9 of the DPA).
6. Reference to current external documentation
Insofar as providers publish their own, continuously updated documents on data protection, sub-processors, security measures or cloud regions, these are additionally authoritative.
This applies in particular to:
- Google Cloud: Cloud Data Processing Addendum and list of Google Cloud sub-processors,
- Microsoft: Product Terms and Data Protection Addendum,
- Stripe, Meta, Twilio: their respective data protection and data processing terms.
7. Summary list
Sub-processors
| Service: | Location of processing: |
|---|---|
Hetzner Online GmbH Hosting | Germany |
Google Cloud EMEA Limited AI (Vertex AI: Gemini, Veo) | EU regions |
Microsoft Ireland Operations Limited AI (Azure OpenAI), where used | EU region |
Shotstack Pty Ltd Video rendering | Australia (Standard Contractual Clauses) |
Twilio Ireland Limited Telephony, recording, WhatsApp transmission (if set up by the agency) | USA (DPF, BCR) |
Voximplant Telephony, recording (if set up by the agency) | in accordance with the DPA (Standard Contractual Clauses) |
Meta Platforms Ireland Limited WhatsApp, Instagram, Messenger, lead forms (if set up by the agency) | Ireland/USA (DPF, SCC) |
With their own responsibility
| Service: | Location of processing: |
|---|---|
Stripe Payments Europe Limited Payment processing, fraud prevention | Ireland/USA (DPF, SCC) |