List of subprocessors

SF-LABS sp. z o.o. processes the personal data of event attendees as a processor acting on behalf of organizers. To run the SF-CONFERENCE system we rely on further processors, known as subprocessors. The list below says who they are, why they receive data and which categories of data are involved.

Every subprocessor works under an agreement that guarantees a level of data protection no lower than the one set out in the Data processing agreement. Under its § 5 we announce every change to this list, and an organizer may raise a reasoned objection to a new subprocessor within 7 days of being notified.

§ 1. Subprocessors

Some of the entities below run core system functions, so their involvement does not depend on the settings of a single event. The rest receive data only once the organizer turns the related feature on, which we note next to every such purpose.

Some of these entities receive no data from the system database. Data reaches them because the visitor's browser downloads a resource straight from their servers, which reveals the IP address and device details.

• DigitalOcean LLC

  The provider of the server the whole system runs on.

  Purpose of processing

  Running the environment that hosts the application and the system database, the place where all processing of event data happens.

  Categories of data

  All data processed in the system, including attendee, entry, payment and invoice data as well as the content of event websites, because the database and the application run on that server.

  Location

  Germany, a data centre in Frankfurt. The provider is based in the United States, and the transfer relies on standard contractual clauses.

• Amazon Web Services EMEA SARL

  The cloud infrastructure provider the system sends mail and stores files through.

  Purpose of processing

  Delivering the messages sent from the system, meaning registration confirmations, entry tickets, certificates, invoices, reminders and mailings, and storing event files, generated documents and database backups.

  Categories of data

  E-mail address, first and last name, the message body and its attachments, files uploaded by organizers and attendees, and the documents the system generates, together with the personal data they carry.

  Location

  European Union, data centres in Ireland and Germany.

• Google Cloud EMEA Limited

  The cloud data warehouse provider the system keeps its technical logs in.

  Purpose of processing

  Recording access events, performed operations and errors, needed to diagnose failures, detect abuse and keep statistics on how the system runs.

  Categories of data

  User identifier, IP address, browser details, request address and method, event instance address, error content and the date and time of the event.

  Location

  European Union, a data centre in Warsaw.

• Google Ireland Limited

  A provider of form protection, measurement tools and resources embedded in event websites.

  Purpose of processing

  Protecting forms against automated submissions by bots. On top of that, once the organizer turns those features on, measuring traffic on the event website and the performance of their advertising campaigns, and displaying embedded videos and fonts.

  Categories of data

  IP address, browser and device details, the way the form was filled in, identifiers stored in cookies and on-site behaviour.

  Location

  Ireland and the United States, under standard contractual clauses.

• OpenAI Ireland Limited

  The provider of the language models behind the assistant in the panel.

  Purpose of processing

  Carrying out the assistant instructions given by the organizer: creating and changing content, looking up information about the event and answering questions about the data in the panel.

  Categories of data

  The text of the instruction together with the event context, which depending on the question may cover attendee, entry, payment and invoice data. Requests are neither stored on the provider side nor used to train models.

  Location

  Ireland and the United States, under standard contractual clauses.

• Stripe Payments Europe Limited, ING Bank Śląski S.A., PayU S.A., PayPro S.A.

  Online payment operators. Data goes only to the operator the organizer connected to the event themselves.

  Purpose of processing

  Collecting the fees for taking part in the event and for extra options, and confirming the status of a transaction.

  Categories of data

  The payer's name or company name, e-mail address, amount, currency, payment title and transaction identifier. Card details go to the operator alone and never reach the system.

  Location

  Poland and Ireland. The operators act as separate data controllers.

• Meta Platforms Ireland Limited, LinkedIn Ireland Unlimited Company

  Advertising networks whose tags the organizer may add to their own tag container.

  Purpose of processing

  Measuring the performance of the organizer's advertising campaigns. The tags load only once the organizer adds them themselves.

  Categories of data

  IP address, identifiers stored in cookies and the actions taken on the event website.

  Location

  Ireland and the United States, under standard contractual clauses.

• Pexels GmbH

  A free stock photo library with a search engine and image files.

  Purpose of processing

  Searching for photos and placing them on event websites.

  Categories of data

  The search phrase typed by the organizer and, when the chosen photo is displayed, the visitor's IP address and browser details.

  Location

  Germany.

• OpenFreeMap, OpenStreetMap Foundation

  Open map services providing the map background and an address search engine.

  Purpose of processing

  Displaying the map with the event venue and turning the entered address into coordinates.

  Categories of data

  The address being searched for plus the IP address and browser details of the person using the map.

  Location

  The European Union and the United Kingdom, the latter under an adequacy decision.

• jsDelivr

  A public content delivery network for programming libraries.

  Purpose of processing

  Loading the editor used in the panel for advanced template and page editing.

  Categories of data

  The IP address and browser details of the organizer using the panel.

  Location

  A server network with global reach.

§ 2. Other data recipients

The entities below are not subprocessors of SF-LABS, because they process data as separate controllers, under the law, or solely on the instruction of the organizer. We list them so the picture of the data flow is complete.

• Public authorities and state registers

  The national system of structured invoices run by the Ministry of Finance and the register of businesses run by Statistics Poland.

  Purpose of processing

  Issuing and submitting invoices in the form required by law, and filling in the company details on an invoice once a tax identification number is entered.

  Categories of data

  The full content of the invoice: the buyer's name and address, tax identification number, line items and amounts.

  Location

  Poland. The transfer follows from a statutory obligation, and the authorities act as separate data controllers.

• Tools chosen by the organizer

  The organizer's own mail server and the external systems they point the event notifications at.

  Purpose of processing

  Sending messages from the organizer's own address instead of the system address, and passing event activity on to their own tools, a CRM system for instance.

  Categories of data

  The recipient's e-mail address, the message body and its attachments, plus event data in the scope set in the notification configuration, including attendee data.

  Location

  Depends on the provider chosen by the organizer, who is responsible for that choice.

§ 3. Contact

Please send questions about this list and objections to new subprocessors to office@sf-labs.com.