Sub-processors

Effective date: January 18, 2026 · Last updated: May 17, 2026

Under Article 28 of the GDPR, TheWiFy must disclose the third-party vendors ("sub-processors") that process personal data on our behalf in delivering the platform. This page is that disclosure.

Customers receive at least 30 days' notice before any new sub-processor is added. Material objections may be raised within that window — see the email address at the bottom of this page.

Current sub-processors

Google Cloud Platform

cloud.google.com

Purpose: Hosting infrastructure, managed Kubernetes, managed Postgres, object storage, secret management.

Data categories: All Customer Data, system logs, encrypted backups.

Processing location: EU (Belgium / Netherlands) for EU customers; US for global customers (configurable on Enterprise plans).

SendGrid (Twilio)

sendgrid.com

Purpose: Transactional + marketing email delivery, unsubscribe management, deliverability monitoring.

Data categories: Recipient email address, email content, delivery + engagement events.

Processing location: US / EU. Standard Contractual Clauses in force.

Twilio

www.twilio.com

Purpose: SMS OTP authentication, SMS marketing campaigns, WhatsApp Business API gateway.

Data categories: Recipient phone number (E.164), message content, delivery receipts.

Processing location: US / EU. Twilio Data Processing Addendum applied.

Stripe

stripe.com

Purpose: Payment processing for WiFi voucher sales, MSP subscription billing, Stripe Connect revenue splits.

Data categories: Cardholder data is captured directly by Stripe (we never see it). Customer name, billing address, payment metadata. PCI-DSS Level 1 compliance handled entirely by Stripe.

Processing location: US, with EU residency available on Stripe Enterprise.

Cloudflare

www.cloudflare.com

Purpose: Global edge CDN, DDoS protection, DNS, TLS termination.

Data categories: IP address, request metadata, TLS handshake metadata. No content storage.

Processing location: Global anycast network. Cloudflare Data Processing Addendum applied.

Google Gemini API

ai.google.dev

Purpose: AI-generated marketing copy via the AI Ad Generator feature. Used only when the customer invokes the feature.

Data categories: Prompt text submitted by the user. Outputs returned. Per Google's enterprise endpoint, prompts and outputs are not retained for model training.

Processing location: EU / US (regional endpoint selectable).

Notification of changes

We notify customers of new or replaced sub-processors at least 30 days before they take effect, via email to the registered account contact. Customers may object in writing within that window; if the objection cannot be reasonably resolved, the customer may terminate the affected service with prorated refund.

Subscribe to sub-processor change notifications by emailing privacy@thewify.com with subject "Sub-processor notifications".

Data Processing Agreement

A Data Processing Agreement (DPA) incorporating EU Standard Contractual Clauses is available on request and is included by default in MSP Scale and Enterprise contracts. Email privacy@thewify.com to request a copy.

Contact

Sub-processor questions, DPA requests, or objections: privacy@thewify.com