Vercel Inc. (US) — Hosting and operation of the portal

• Data categories: Account and usage data
• Processing location: Storage in the EU; compute possibly outside the EU, safeguarded by EU Standard Contractual Clauses
• Third-country safeguard: SCCs (Art. 46), CLOUD Act consideration

Neon Inc. (US) — Database

• Data categories: Account and contract data
• Processing location: Frankfurt (EU)
• Third-country safeguard: SCCs (Art. 46), CLOUD Act consideration

PostHog Inc. (US) — Product and activity analytics

• Data categories: Usage / event data, clicks on links in emails
• Processing location: EU storage
• Third-country safeguard: SCCs (Art. 46), CLOUD Act consideration

HubSpot (US) — Customer relationship management (CRM)

• Data categories: Contact, profile and interaction data
• Processing location: EU hosting
• Third-country safeguard: SCCs (Art. 46), CLOUD Act consideration

Twenty (self-hosted) — Customer relationship management (CRM)

• Data categories: Contact, profile and interaction data
• Processing location: own servers, Germany (EU)
• Third-country safeguard: — (no third-party access, no transfer)

n8n (self-hosted) — Workflow automation

• Data categories: Usage / event data
• Processing location: Frankfurt, own infrastructure (EU)
• Third-country safeguard: — (no transfer to third parties)

Google Ireland Ltd. / Google LLC (US) — Login (OAuth “Sign in with Google”) and one-tap sign-in on our websites

• Data categories: Sign-in / identity data
• Processing location: EU/US
• Third-country safeguard: SCCs (Art. 46)

Kegon AG (affiliated company, processor) — Support for events and service delivery

• Data categories: Communication and event data
• Processing location: EU
• Third-country safeguard: Data processing agreement under Art. 28 GDPR concluded

pretix (rami.io GmbH) (DE) — Order, invoicing, and payment processing for event tickets (Invite ticket shop)

• Data categories: Order, invoice, and payment data
• Processing location: Germany (EU)
• Third-country safeguard: Data processing agreement under Art. 28 GDPR concluded

Twilio Inc. (US) — SMS / text-message delivery (sub-processor)

• Data categories: Mobile number, opt-in status, message content, routing data
• Processing location: USA
• Third-country safeguard: Adequacy decision C(2023) 4745 + EU-US Data Privacy Framework (self-certified); DPA concluded

Verda (DataCrunch Oy, Finland) — GPU infrastructure for running self-hosted AI models

• Data categories: Content of AI requests, connection and usage data
• Processing location: Helsinki, Finland (EU)
• Third-country safeguard: Data processing agreement under Art. 28 GDPR (Data Processing Terms of the terms of service); processing within the EEA

Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg) — Email delivery (Amazon SES) for newsletters and confirmation emails

• Data categories: Email address, email content, delivery, bounce and complaint data
• Processing location: Frankfurt am Main (EU)
• Third-country safeguard: Data processing agreement under Art. 28 GDPR (AWS GDPR Data Processing Addendum as part of the AWS Service Terms), SCCs (Art. 46), CLOUD Act consideration

Hetzner Online GmbH (DE) — Hosting of the newsletter endpoint connect.seibert.group and the short link service seibert.link

• Data categories: Email address, sign-up and click data, IP address
• Processing location: Nuremberg (EU)
• Third-country safeguard: Data processing agreement under Art. 28 GDPR (Hetzner standard agreement); processing within the EEA

YouTube (YouTube LLC / Google Inc., USA) — Embedding of videos

• Data categories: page visited; for signed-in users, association with the YouTube account

Reddit Inc. (Reddit Inc., USA) — Advertising on Reddit and measuring its performance (Reddit pixel and server-side Conversions API)

• Data categories: page visited, IP address, device/browser information, the ad click identifier; on a sign-up or sign-in additionally the hashed email address
• Processing location: USA (Reddit servers)
• Third-country safeguard: Consent (Art. 49(1)(a)); the pixel is only loaded after consent in the cookie banner

Social-Media-Plattformen (Facebook, X/Twitter, LinkedIn, Instagram; partly outside the EU) — Company profiles with plugins

• Data categories: Visit data; on login, association with the respective account; IP address, device/browser information

Google Maps (Google LLC, USA) — Map embedding

• Data categories: IP address
• Processing location: USA (Google servers)

Typeform S.L. (Spain, EU) — Surveys / forms

• Data categories: Access data (IP address), input data
• Third-country safeguard: DPA (Art. 28)

DISQUS Inc. (USA) — Comment function

• Data categories: Email address, IP address

Wix.com — Website builder for embedded content

• Data categories: Name, email address, IP address, location

Spotify — Music widget

• Data categories: IP address, browser/operating-system information, widget usage data

SalesViewer® GmbH (Germany) — Website analytics (B2B visitor recognition, pseudonymized)

• Data categories: company-related data (hashed/pseudonymized)

Microsoft Clarity (Microsoft Ireland Operations Ltd., Ireland/EU) — Web analytics

• Data categories: pseudonymous user ID, usage behaviour
• Third-country safeguard: Adequacy decision (Art. 45 GDPR)

AddEvent, Inc. (USA) — Calendar-entry creation

• Data categories: Access data, event data

Calendly Inc. (USA) — Online appointment booking

• Data categories: Contact and appointment data
• Third-country safeguard: EU-US Data Privacy Framework, SCCs (Art. 46 GDPR)