Sub-processor list
The companies that process personal data on behalf of Libaty GmbH when you use PEAKTEAMS, what each one does, where it processes data and on which legal basis data leaves the EU. The list is maintained from the application code, not from memory: a provider is listed when the code calls it.
- Last updated:
- · Version 1.0
- Controller:
- Libaty GmbH, Heusenstamm, Germany
- Contact:
- legal@peakteams.io
The PDF is produced by your browser's print dialog (choose “Save as PDF”). We do not generate PDFs on our servers.
Last updated: 19 October 2026. This page is the authoritative list referred to in clause 9 of our data processing agreement and section 15 of the privacy policy.
Sub-processors
“Consent” marks providers that only run after a visitor has allowed analytics in the cookie banner. The others are required to operate the service.
| Provider | Purpose and data | Where data is processed | Legal basis for transfer | Documents |
|---|---|---|---|---|
| Supabase Inc. USA | Database, authentication, file storage (team photos) Accounts, teams, invited members, survey answers, results, email delivery logs | AWS data centre in Ireland (eu-west-1) | Data is stored in the EU. Support access from outside the EU is covered by the EU Standard Contractual Clauses in the provider’s DPA. | DPA · Privacy |
| Vercel Inc. USA | Hosting and application servers, image optimisation Request data (IP address, user agent, requested page) for every visitor; application data passes through the servers in Dublin | Serverless functions in Dublin, Ireland (region dub1). Static assets and cached pages are delivered through Vercel’s global edge network. | Application processing in the EU. The edge network and support access are covered by the EU Standard Contractual Clauses in the provider’s DPA. | DPA · Privacy |
| Resend USA | Transactional email: survey invitations and reminders, account emails, contact form delivery Recipient name and email address, subject, email body (which contains the personal survey link) | USA | Transfer to the USA under the EU Standard Contractual Clauses, or the EU–US Data Privacy Framework where the provider is certified. | Privacy |
| Functional Software Inc. (Sentry) USA | Error monitoring; Session Replay only with analytics consent Technical error data: page, browser, error message, stack trace. User information is not sent; page URLs are redacted of survey tokens. | EU data region (Germany) | Data is stored in the EU. Support access from the USA is covered by the EU Standard Contractual Clauses in the provider’s DPA. | DPA · Privacy |
| PostHog Inc. USA Consent | Product analytics: page views and product events Pseudonymous user ID, page views, events such as “survey started”. Never survey answers. Personal survey links are redacted before sending. | EU data region | Data is stored in the EU. Support access from the USA is covered by the EU Standard Contractual Clauses in the provider’s DPA. | DPA · Privacy |
| Google Ireland Limited Ireland Consent | Google Analytics 4: website usage statistics Page views and website interactions, pseudonymous client ID | EU and USA (Google LLC) | Transfer to Google LLC in the USA under the safeguards in Google’s data processing terms (EU Standard Contractual Clauses, or the EU–US Data Privacy Framework where Google is certified). | Processing terms · Privacy |
| Ahrefs Pte. Ltd. Singapore | Cookieless website statistics (production site only) Page views; the browser sends the IP address and user agent when the script loads. No cookies, no storage on the device. | USA (Ahrefs’ privacy policy states that data is stored in the United States) | Only the IP address and user agent sent at script load leave the EU. Ahrefs offers the EU Standard Contractual Clauses (Module 2) in its data processing addendum; they take effect once the customer signs Annex I. We will list the signed safeguard here once it is in place. | DPA · Privacy |
Transfer safeguards: where a provider is based outside the EU or may access data from there, we rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) contained in that provider's data processing agreement, or on the European Commission's adequacy decision for providers certified under the EU–US Data Privacy Framework. Which of the two applies to a given provider is stated in that provider's DPA; we do not assert certifications on their behalf. Copies of the safeguards are available from legal@peakteams.io.
Not sub-processors
- Sign in with Google (Google Ireland Limited) is an independent controller for the sign-in itself. It is only used if a user chooses it.
- Fonts. The site's fonts are bundled with the application at build time and served from our own hosting; no request goes to a font provider when a page loads.
- Team owners who invite members are not sub-processors. Depending on the setup they are the controller (or act for it) and see only the aggregated results described in the works council one-pager.
How changes are announced
- This page is the record. Every change updates the “last updated” date at the top and the version number.
- Customers with a signed DPA receive an email to the contact named in the DPA at least 30 days before a new sub-processor processes their data, with a right to object as set out in clause 9 of the DPA. Replacing a provider's region or purpose counts as a change.
- Removing a provider, or a change that reduces the data a provider receives, is announced on this page only.
- Anyone can ask to be notified of changes by writing to legal@peakteams.io.
How this list is kept accurate
Each entry corresponds to a dependency in the PEAKTEAMS source code: the database and authentication client, the hosting region configuration (dub1), the email service, the error monitoring configuration (EU ingest endpoint), the analytics providers and their regional endpoints. When a dependency is added, this page is updated in the same change. A provider that is not called by the code is not listed, even if we hold an account with it.