Annex 3: list of sub-processors
Version of 24 September 2026
This list constitutes Annex 3 to the data processing agreement concluded between DCNG SRL, publisher of the Onelia platform, and each of its clients. It is updated in accordance with the procedure laid down in Article 9 of that agreement: any addition or replacement of a sub-processor is communicated by email to the administrator of the account of each client and published at the above address at least fifteen days before it takes effect, the client having that period in which to raise a reasoned objection at privacy@dcng.be. The updates of this list do not amend the text of the agreement and call for no new acceptance.
Unless otherwise stated, the personal data are processed within the European Union. Where a transfer to a third country is identified, the transfer mechanism which applies is indicated: standard contractual clauses of the European Commission, hereinafter “SCCs”, or certification under the EU-US Data Privacy Framework, hereinafter “DPF”, cumulatively where applicable.
1. Sub-processors involved in the supply of the Service
| Sub-processor | Role | Data concerned | Place of processing and transfer | Contractual framework |
|---|---|---|---|---|
| Supabase Pte. Ltd (Singapore), Supabase Inc. group (United States), Amazon Web Services infrastructure | Database, authentication, file storage and server logic: main hosting of all the Client Data | All the categories in Annex 1 | European Union, Ireland region; the storage and the main processing are contractually limited to the region chosen. Any remote access from a third country is framed by SCCs | Data processing agreement signed, SCCs, SOC 2 type 2, ISO/IEC 27001. Downstream providers: list annexed to the provider’s data processing agreement |
| Journey Mobile, Inc. (PowerSync) (United States) | Offline synchronisation service of the mobile application: the data synchronised to the devices pass through it and are buffered there | Data synchronised to the mobile application | European Union: dedicated instance in the Ireland region. Any access from the United States is framed by SCCs | Countersigned data processing agreement, SCCs. List of downstream providers: powersync.com/legal/subprocessors |
| OVH SAS (OVHcloud) (France) | Hosting of the app.onelia.be web portal on a virtual private server, of the onelia.be website, of the domain and of the mailboxes, including the support mailbox; provision of the calendar invitation response page and relaying of the calendar feed | All the data displayed or entered in the portal, in transit; data appearing in support reports; tokens appearing in the calendar subscription addresses, in the server logs | European Union (France) | Data processing agreement incorporated into the provider’s terms; ISO/IEC 27001, 27017 and 27018 certifications |
| Cloudflare, Inc. | Storage of the backup copies of the files, encrypted by Onelia before sending, temporary deposit of the retrieval exports and delivery of the public media of the website | File backups in encrypted form, including the file names; retrieval exports in clear form, purged after seven days | European Union: storage jurisdiction set on the storage areas concerned | Data processing agreement incorporated into the provider’s terms, SCCs |
| GitHub, Inc. (Microsoft group) | Automated execution of the backup tasks and of the generation of the retrieval exports | Transit of the backup data and of the exports in the memory of the execution servers during the task, before encryption and storage; retention of the encrypted backup artefacts for ninety days | Transit outside the European Union is possible, since the execution infrastructure does not allow a region to be selected; transfer framed by SCCs and by the DPF certification of Microsoft | Data processing agreement incorporated into the provider’s customer contract, entered into in the name of DCNG SRL |
| MINDBAZ SAS (Sweego), 19 rue d’Amiens, 59800 Lille (France), RCS 893 278 382 | Sending of the transactional emails of the Service, including the documents attached, the notifications, the connection emails and the alerts; receipt of the responses of end customers to calendar invitations | Email addresses of the recipients, content of the emails and attachments containing the identity of the end customers; email address and response of the end customers invited | European Union (France): hosting with providers established in France; no transfer to a third country | Data processing agreement incorporated into the provider’s terms, version of 15 July 2026; logs retained for thirty days; downstream providers all established in the European Union |
| Google Ireland Limited / Google LLC (Firebase Cloud Messaging) | Routing of the push notifications to Android and iOS devices | Device tokens and texts of the notifications, reduced to the number of the document and the time, to the exclusion of the names of end customers | Worldwide service with no guaranteed location; transfer framed by the DPF certification of Google and by SCCs | Firebase Data Processing and Security Terms |
| Apple Distribution International Ltd (Apple Push Notification service) | Routing of the push notifications to iOS devices | Device tokens and texts of the notifications, reduced to the number of the document and the time | Worldwide service; transfer framed by the DPF certification of Apple | Apple Developer Program Licence Agreement and the terms applicable to the notification service |
| Functional Software, Inc. (Sentry) | Collection of the technical error reports of the application and of the portal | No personal data by configuration; mentioned for the sake of transparency | European Union | Data processing agreement incorporated into the provider’s terms |
| BRBX BV (Recommand) (Belgium) | Peppol network access point provider: issuing of the structured electronic invoices, verification of the identity of the undertaking, directory | Invoicing data of the invoices issued, comprising identity, addresses and amounts; identification data of the Client’s legal representative on activation, supplied directly by that representative to the provider | European Union | Data processing agreement incorporated into the provider’s terms. Downstream providers: recommand.eu/en/legal/subprocessors, including Didit for identity verification. Active only for the clients who activate electronic invoicing |
| KEPTAGO LTD (Geoapify) (Cyprus) | Supply of the map tiles displayed in the mobile application | IP address of the device and map areas consulted; no end customer address is transmitted | European Union and European Economic Area exclusively | Data processing agreement incorporated into the provider’s terms |
2. Public services consulted, outside sub-processing
For the verification of value added tax numbers and company data as well as for the suggestion and geocoding of addresses situated in France and in Luxembourg, the Service queries official public services: the VIES system of the European Commission, the Crossroads Bank for Enterprises, the Base Adresse Nationale and the geoportal of the Luxembourg State. The data entered are transmitted as a query to those services, which process them under their own responsibility; nothing is stored there by Onelia. Belgian addresses are processed by means of an address database hosted by Onelia and are transmitted to no third party. Those services are not sub-processors of Onelia and are mentioned for the sake of transparency.
3. Recipients chosen by the Client, outside sub-processing
The calendar providers to which a User chooses to subscribe its schedule, in particular Google, Microsoft and Apple, are not sub-processors of Onelia. Onelia makes a calendar file available behind an address containing a secret and it is the calendar software chosen by the User which reads it; Onelia sends no data on its own initiative to those providers and has no contractual relationship with them. They are recipients of the Client within the meaning of Article 4(9) of the GDPR, under the conditions described in Article 6 of the Agreement. That classification would have to be reconsidered if the Service were itself to push the data to those services, in particular by means of two way synchronisation.
4. The publisher’s own tools, outside scope
The external availability probe, which calls only a public checkpoint returning an operating status, and the trade mark watch probe, which sends only search terms to a public database, process no personal data of clients and do not appear in this list. They are mentioned in Onelia’s internal record of processing activities.