Sub-processors

Civic Patches GmbH uses the following sub-processors to operate the platform. All are bound by data processing agreements under Art. 28 GDPR; data is processed in the EU/EEA unless stated.

Provider: Hetzner Online GmbH
Location: Gunzenhausen, Germany; data centre in Nuremberg, Germany.
Purpose: Hosting, storage, and backups of the platform.
Provider: Scaleway SAS
Location: Paris, France.
Purpose: Transactional email delivery, including notifications and confirmations.
Provider: Microsoft Ireland Operations Ltd.
Location: Dublin, Ireland; Azure OpenAI Service in an EU region.
Purpose: AI inference for optional AI features, including photo classification, duplicate detection, privacy flagging, and the onboarding assistant. It is used only after personal data has been removed from free text by a redaction service running on Civic Patches infrastructure. No data is used for model training.
Provider: OpenFreeMap (Hyperknot Software Kft.)
Location: Public map tile service, European Union.
Purpose: Map tiles loaded by the browser on the default map style. The service receives the visitor's IP address to deliver tiles; no report data is transmitted. Used where no other tile provider is configured.
Provider: MapTiler AG
Location: Unterägeri, Switzerland; covered by an adequacy decision.
Purpose: Map tiles loaded by the browser where a tenant has configured a MapTiler map style. MapTiler receives the visitor's IP address to deliver tiles.
Provider: Mapbox, Inc.
Location: United States; services use an AWS primary region in the United States and global CDN caching.
Purpose: Address search and reverse geocoding. Search terms, coordinates, IP addresses, browser and device data, and request metadata may be processed. Standard contractual clauses cover international transfers where applicable.
Provider: komoot GmbH (Photon)
Location: Schönefeld, Germany.
Purpose: Address search and reverse geocoding. Photon may be the configured provider or a fallback if another provider fails. Photon receives search terms, coordinates, and the IP address to provide the service.

Last updated: 2 September 2026.

Changes to this list are announced on this page.