Vinkius Subprocessors

1. Introduction

This Subprocessor List ("List") identifies all third-party service providers ("Subprocessors") engaged by Vinkius to process Personal Data on behalf of our customers in connection with the provision of Vinkius services (the "Services").

This List is maintained pursuant to Vinkius's Data Processing Agreement (DPA) and in compliance with GDPR Article 28(2) and 28(4).

Important: By using Vinkius's Services, customers provide general authorization for Vinkius to engage the Subprocessors listed below, subject to the notification and objection procedures described in Section 4 of this document and in our DPA.

2. What is a Subprocessor?

A Subprocessor is a third-party service provider engaged by Vinkius (as a Processor) to process Personal Data on behalf of our customers (Data Controllers) in connection with providing the Vinkius platform and services.

Examples of Subprocessors include:

• Cloud hosting and infrastructure providers
• Payment processors
• Email delivery services
• Customer support platforms
• Analytics and monitoring tools
• Security and fraud prevention services

Not Subprocessors:

The following are not considered Subprocessors under GDPR:

• Services that do not process customer Personal Data (e.g., internal tools used only by Vinkius employees)
• Services where Vinkius acts as a Data Controller (e.g., our own analytics for business operations)
• Independent Data Controllers who process data for their own purposes pursuant to their own terms

3. Current Authorized Subprocessors

The following Subprocessors are currently authorized to process Personal Data on behalf of Vinkius customers:

3.1 Infrastructure and Hosting Services

Purpose: Provides the foundational cloud infrastructure for the Vinkius platform, including servers, storage, databases, and networking resources.

Safeguards for International Transfers: Standard Contractual Clauses (SCCs) and AWS GDPR Data Processing Addendum.

3.2 Payment Processing

Purpose: Processes all subscription payments, manages billing, and generates invoices for Vinkius customers.

Important Note: Vinkius does not directly store or access full payment card details. Payment card information is collected and processed solely by Stripe in accordance with PCI-DSS standards.

Safeguards for International Transfers: EU-U.S. Data Privacy Framework certification, Standard Contractual Clauses (SCCs), and Stripe DPA.

3.3 Email Delivery Services

Purpose: Delivers transactional emails from Vinkius to users, including account notifications, password reset emails, system alerts, and platform updates.

Note: Marketing emails (if any) are managed separately and may use different services.

Safeguards for International Transfers: Standard Contractual Clauses (SCCs) and AWS GDPR Data Processing Addendum.

3.4 Analytics and Performance Monitoring

Google Analytics

Purpose: Analyzes platform usage, user behavior, and performance metrics to improve Vinkius's Services and user experience.

Configuration: Vinkius enables IP anonymization in Google Analytics to enhance privacy protection.

Safeguards for International Transfers: EU-U.S. Data Privacy Framework certification (Google LLC), Google Ads Data Processing Terms, IP anonymization.

3.5 Marketing and Advertising

Purpose: Enables targeted advertising, measures campaign effectiveness, and builds audiences for marketing purposes.

Note: Facebook Pixel is only active for users who have consented to marketing cookies in accordance with our Cookie Policy.

Safeguards for International Transfers: EU-U.S. Data Privacy Framework certification, Standard Contractual Clauses (SCCs).

4. Notification of Changes to Subprocessors

4.1 Advance Notice Requirement

Vinkius will provide customers with at least 30 days' prior written notice before:

• Adding a new Subprocessor, or
• Replacing an existing Subprocessor with a different provider

4.2 Notification Methods

Notice of Subprocessor changes will be provided through the following methods:

1. Email Notification: Sent to the email address associated with the customer's Vinkius account
2. Update to this List: This Subprocessor List will be updated with the new Subprocessor information and the date of the update
3. Email Subscription (Optional): Customers may subscribe to receive automated email notifications of Subprocessor changes by emailing subprocessors[at]Vinkius.com with "Subscribe to Subprocessor Updates" in the subject line

Note: The updated Subprocessor List will always reflect the "Last Updated" date at the top of this document.

4.3 Customer Objection Rights

If a customer has legitimate grounds related to data protection for objecting to Vinkius's appointment of a new Subprocessor, the customer must:

1. Notify Vinkius in writing within 30 days of receiving notice of the new Subprocessor
2. Submit objection to: legal[at]Vinkius.com or dpo[at]Vinkius.com
3. Clearly state the grounds for objection, including specific data protection concerns

Resolution Process:

• Vinkius will use reasonable efforts to address the customer's concerns or provide an alternative solution (e.g., not using the Subprocessor for the customer's data, migrating to a different Subprocessor, or implementing additional safeguards)
• If Vinkius cannot provide a reasonable alternative within 60 days and the customer maintains a legitimate objection, the customer may terminate the affected portion of the Services (or the entire Services if the Subprocessor is essential) without penalty or fees for the remainder of the prepaid term

Deemed Acceptance: If the customer does not object within 30 days of notice, the customer is deemed to have accepted the new Subprocessor.

5. Subprocessor Management and Compliance

5.1 Vinkius's Obligations

Vinkius confirms that all Subprocessors:

• Enter into written contracts with data protection terms substantially equivalent to Vinkius's DPA, including:
• Comply with GDPR and applicable data protection laws
• Process Personal Data only in accordance with the customer's documented instructions (as provided through Vinkius)
• Implement appropriate security measures to protect Personal Data

5.2 Vinkius's Liability

Vinkius remains fully liable to customers for the performance of any Subprocessor's obligations under the DPA, as if Vinkius were performing the services directly.

If a Subprocessor fails to fulfill its data protection obligations, Vinkius remains directly liable to the customer for the Subprocessor's failure to perform its obligations.

5.3 Due Diligence and Monitoring

Vinkius conducts due diligence on all Subprocessors before engagement, including:

• Review of security certifications (e.g., ISO 27001, SOC 2 Type II)
• Assessment of data protection policies and practices
• Evaluation of technical and organizational security measures
• Verification of compliance with GDPR and applicable data protection laws

Vinkius performs ongoing monitoring of Subprocessor performance and compliance through:

• Periodic reviews of Subprocessor security posture
• Review of Subprocessor security incident reports
• Monitoring of Subprocessor certifications and audit reports

6. International Data Transfers

6.1 Data Transfer Mechanisms

When Subprocessors process Personal Data outside the European Economic Area (EEA), Vinkius confirms that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs): European Commission-approved Standard Contractual Clauses (2021) with Subprocessors located in Third Countries
• Adequacy Decisions: Transfers to countries recognized by the European Commission as providing adequate data protection (e.g., UK, Switzerland, select others)
• EU-U.S. Data Privacy Framework (DPF): For transfers to U.S. entities certified under the DPF (e.g., Stripe, Google)
• Supplementary Measures: Additional technical and organizational measures (e.g., encryption, pseudonymization) where required by Transfer Impact Assessments (TIAs)

6.2 Verification

Customers may verify the data transfer mechanisms and certifications for each Subprocessor by:

• Reviewing the Subprocessor's privacy policy (linked in Section 3)
• Contacting Vinkius at legal[at]Vinkius.com or dpo[at]Vinkius.com to request additional information
• Verifying EU-U.S. DPF certification at: https://www.dataprivacyframework.gov/list

7. Audit Rights

Customers have the right to audit Vinkius's compliance with Subprocessor requirements as described in Section 11 of the Vinkius Data Processing Agreement.

Upon written request, Vinkius will provide:

• Copies of Subprocessor data processing agreements (with commercially sensitive information redacted)
• Evidence of Subprocessor security certifications (e.g., ISO 27001, SOC 2 Type II reports)
• Summary of due diligence conducted on Subprocessors

Requests should be submitted to: legal[at]Vinkius.com or dpo[at]Vinkius.com

8. Subprocessor Categories Summary

For easy reference, the following table summarizes Subprocessor categories and the types of Personal Data processed:

9. Updates and Version History

Vinkius maintains a record of all updates to this Subprocessor List:

To view previous versions of this Subprocessor List, please contact: legal[at]Vinkius.com

10. Contact Information and Subscription

10.1 General Inquiries

For questions, concerns, or requests regarding Subprocessors or data processing, please contact:

10.2 Subscribe to Subprocessor Updates

To receive automated email notifications whenever this Subprocessor List is updated (new Subprocessors added or existing Subprocessors changed), send an email to:

You will receive a confirmation email and will be notified of all future Subprocessor changes at least 30 days in advance.

11. Additional Resources

• Vinkius Data Processing Agreement (DPA): /legal/data-processing-agreement
• Vinkius Privacy Policy: /legal/privacy-policy
• Vinkius Security Policy: /legal/security
• Vinkius Terms and Conditions: /legal/terms-and-conditions

12. Legal Disclaimer

This Subprocessor List is provided for informational purposes and constitutes part of Vinkius's Data Processing Agreement (DPA). By using Vinkius's Services, customers agree to the terms of the DPA, including the engagement of Subprocessors listed herein, subject to the notification and objection procedures described in this document.

Vinkius reserves the right to update this Subprocessor List from time to time in accordance with the notification procedures set forth in Section 4.

Effective Date: This Subprocessor List is effective as of March 3, 2026, and applies to all customers using Vinkius Services.