Sub-processors
Effective date: 16 July 2026 (v1.0) Last updated: 16 July 2026
This page lists the sub-processors OfferLink engages to process end-customer personal data on behalf of the businesses using the service, as described in our Data Processing Agreement.
Sub-processors of end-customer data
| Sub-processor | Purpose | Personal data disclosed | Location / hosting | Transfer safeguard |
|---|---|---|---|---|
| Resend | Transactional email delivery (quote notifications, links) | Recipient email address, names, quote references/amounts, and the unique quote link containing a bearer access token that is sent in the transactional email | United States | EU-U.S. Data Privacy Framework certification, with EU Standard Contractual Clauses incorporated into Resend’s DPA as an additional safeguard. |
| Hetzner Object Storage | Storage of end-customer uploaded photographs | Uploaded photographs (may contain EXIF/GPS metadata) | Falkenstein, Germany (EEA) | No third-country transfer. Processing under Hetzner’s standard data-processing agreement. |
| Hetzner (infrastructure host) | Hosting of the self-hosted PostgreSQL primary datastore (all operator and end-customer data) and its backups | All personal data described in the Data Processing Agreement | Germany (EEA) | No third-country transfer. Processing under Hetzner’s standard data-processing agreement. |
Copies of the sub-processor data-processing agreements referenced above are available on request via hello@offerlink.me.
Providers that are not sub-processors
The following providers are not sub-processors of end-customer data under the Data Processing Agreement and are listed only for transparency:
- Clerk (authentication and identity management) processes operator/admin account data (operator names and emails; organisation name and logo). It does not receive end-customer request data. OfferLink acts as an independent controller for that account data under its Privacy Policy; Clerk is US-based and that transfer is safeguarded by Clerk’s EU-U.S. Data Privacy Framework certification with EU Standard Contractual Clauses as a fallback.
- Umami (usage analytics) is self-hosted by OfferLink on its own Hetzner infrastructure in Germany (EU) - no third party receives the data. It is cookieless and runs on OfferLink’s marketing site and the application, including the hosted end-customer request and quote pages; page paths are templated (e.g.
/q/:publicReference), access tokens are never transmitted, and no end-customer request data is captured. OfferLink acts as an independent controller for this aggregate, non-identifying measurement under its Privacy Policy.
Changes
Before any new or replacement sub-processor begins processing, OfferLink will email every Operator at the email address associated with its account at least 30 calendar days in advance. The notice will identify the provider, its processing purpose, processing location, transfer safeguards, and effective date.
An Operator may object on reasonable data-protection grounds by emailing hello@offerlink.me before the effective date. OfferLink and the Operator will seek in good faith to resolve the objection. If the objection remains unresolved, the Operator may stop using the service and request the return or deletion of its data before the new or replacement sub-processor begins processing.