EN
Log in

Legal

Annex 2 — Recipients of personal data

This is a convenience translation. Only the German version is legally binding.

to the Data Processing Agreement (DPA) pursuant to Art. 28 GDPR — Tapcoat
Last updated: May 2026

This Annex identifies all entities to which personal data is transferred, or by which personal data is processed, in connection with the Tapcoat platform. It is divided into four legally distinct sections:

  • Section A — Processors pursuant to Art. 28 GDPR (DPA required)
  • Section B — Joint controllers pursuant to Art. 26 GDPR (joint controller agreement instead of a DPA)
  • Section C — Independent controllers (recipients not bound by instructions, no DPA)
  • Section D — Tools without intended processing of Client data

The controller authorizes the sub-processors listed in Section A. Changes or additions will be announced at least 30 days in advance in accordance with the Main Agreement; the controller’s right to object remains unaffected.

Transfers to third countries are indicated in the “Legal safeguards” column. In each case, they are safeguarded by the EU Standard Contractual Clauses (Module 2, Implementing Decision 2021/914) and — where applicable — by the adequacy decision on the EU-US Data Privacy Framework of July 10, 2023.

Section A — Processors pursuant to Art. 28 GDPR

Section B — Joint controllers pursuant to Art. 26 GDPR

For the following recipients, an agreement on joint controllership pursuant to Art. 26 GDPR is the relevant instrument; a conventional DPA pursuant to Art. 28 GDPR is not applicable here. Processing is based on the corresponding cookie and tracking consents of website visitors.

Section C — Independent controllers

The following recipients do not act on Tapcoat’s instructions but as controllers in their own right within the meaning of Art. 4(7) GDPR. There is therefore no need to conclude a data processing agreement; the respective professional or confidentiality obligations apply.

Section D — Tools without intended processing of Client data

The following tools are used by Tapcoat employees but are not approved for the processing of personal Client data. There is an internal instruction not to enter any real Client data into these systems. Should the scope of use change and personal data of Clients be processed in the future, it is mandatory to include the tools in Section A and to inform the controllers in advance.

Supplementary notes

  • Third-country transfers: For Apple, Google, DigitalOcean (not Hetzner — processing in Germany), Sentry, Cloudflare, GitHub, GitLab, HubSpot, ActiveCampaign, and Dropbox, transfers take place outside the EU/EEA. In each case, they are safeguarded by Standard Contractual Clauses (Module 2, Implementing Decision 2021/914) and — where applicable — additionally by the adequacy decision on the EU-US Data Privacy Framework of July 10, 2023.
  • Apple / APNs: According to its own statement, Apple Distribution International Limited does not classify itself as a processor within the meaning of Art. 28 GDPR for the Apple Push Notification Service (APNs), as the payload cannot technically be viewed.
  • Capawesome (Genz IT): Sub-sub-processors (in particular CDN and database providers) are governed by the DPA between Tapcoat and Capawesome and are not the subject of this Annex.
  • Sentry: Processes data in the USA. IP masking is enabled on the server side.
  • Wallet pass generation: Takes place in the Tapcoat backend (DigitalOcean FRA1). If Tapcoat uses external pass generation services in the future, this list must be supplemented accordingly.
  • DigitalOcean data residency: Processing takes place in the German data centers of the hosting providers used: DigitalOcean FRA1 (Frankfurt am Main) and Hetzner (Falkenstein/Nuremberg).