Sub-processor List

What this list is

A sub-processor is a provider that processes personal data on behalf of CashXChain UG (haftungsbeschränkt) (“CashXChain”) and on our instructions, under a Data Processing Addendum pursuant to Article 28 GDPR. The tables below are the complete list of our sub-processors: what each does, where it processes data, the transfer safeguard, the Article 28 agreement in force between that provider and us, where that provider states how it handles personal data, and the provider’s own sub-processor list. Where a cell is empty, the provider does not publish that document.

A provider that decides the purposes and means itself, or decides them together with us, is a controller rather than a sub-processor and is not in these tables. Those relationships are described in prose after the tables, each with the reason it falls outside Article 28.

A. Product and infrastructure sub-processors

These process personal data as part of delivering the CashXChain platform itself, our public websites and our email communications.

B. Internal operations sub-processors

These are not part of the platform. We use them for internal work — drafting, analysis, correspondence and day-to-day administration — where documents and communications may contain personal data of our employees and interns, of partner staff, and of the representatives of our business customers. They do not process customer transaction data, and they sit outside the payment flow.

Our sub-processors’ own sub-processors

Each provider above engages its own sub-processors under Article 28(4) GDPR . Each is contractually required to impose equivalent data-protection obligations on its own sub-processors and remains liable to us for them. The right-hand column links to each provider’s current list.

Social-login identity providers

If you choose to sign in with Google, Apple, Microsoft, GitHub or LinkedIn, that provider processes your data during the sign-in process under its own terms. It is not a CashXChain sub-processor: it determines its own purposes and means for that processing and is responsible for it in its own right as an independent controller. We receive only the account information you authorise it to release.

Content embedded on our website

Our contact page embeds a Google Maps map and our Google Calendar booking page; both load without a click. Our blog embeds a YouTube video (youtube-nocookie.com), which loads only when you press play. When any of this content loads, your browser connects to Google, and Google receives your IP address, browser and device details and the address of our website; for the map, Google also receives the full address of our contact page. The decision to embed this content, and so to have that data sent to Google, is ours. Google does not process the data on our behalf or on our instructions, so it is not a CashXChain sub-processor. Google decides itself, under its own terms, what it does with the data once it has received it, and is responsible for that in its own right. For visitors in the European Economic Area and Switzerland, the Google company concerned is Google Ireland Limited; elsewhere it is Google LLC. Details are in the Cookie Policy.

Mobile app distribution

Our mobile apps are distributed through Google Play (Google LLC) and the Apple App Store (Apple Inc.). Where you download or use the apps through those stores, the store operator is not a CashXChain sub-processor: it determines its own purposes and means for the data it collects about downloads, payments and device state, and is responsible for it in its own right as an independent controller.

Licensed Partners: independent controllers and joint controllers

The licensed institutions that perform the regulated payment, conversion, custody and settlement steps are not sub-processors. None of them acts on our instructions, and we cannot instruct any of them out of what its regulator requires. They are named on Regulatory Status & Partner Disclosure. Their role under data protection law is not the same for all of them.

Independent controllers. Most Partners determine the purposes and means of their processing entirely by themselves under their own licence and their own regulatory obligations, and are responsible for it in their own right. We answer for our processing and the Partner answers for its own; neither of us answers for the other’s. Stripe is in this group.

Joint controllers with us. For some processing we and a Partner determine the purposes and means together, which makes us joint controllers for it under Article 26 GDPR . Our agreement with Sokin puts the onboarding, account and instruction data we pass to Sokin in this category. Joint controllership does not mean shared systems or mutual access to each other’s records; it means we are accountable together for that processing. For you it has two practical consequences. You may exercise your data-protection rights against either of us, and Article 82 GDPR  makes each joint controller liable for the whole of the damage caused by processing that infringes the Regulation — so you may claim the full amount from either of us, and we settle the split between ourselves afterwards. An arrangement under Article 26 GDPR  allocates the respective responsibilities between the joint controllers; its essence is published here once it is in place.

Identity verification

Partners run their own KYC/KYB under their own obligations and are not our processors for it. Whether a given Partner is an independent controller or a joint controller with us follows the split above.

International transfers

Where a sub-processor processes personal data outside the EEA and the destination is not covered by an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses together with a transfer impact assessment and any supplementary measures the assessment shows are needed.

Changes

We keep this list current in our Legal Center. When we add or replace a sub-processor we update this page and, where the DPA requires it, give business customers advance notice so they may object. Questions: [email protected].