Sub-processor List
Version 1.0.0 · Effective from 20 September 2026
Velyora Sub-processor List
Version 1.0.0, effective 20 September 2026.
Sub-processors, locations and transfer safeguards
| Sub-processor | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| OVH Hispano SL | Hosting | Everything the service stores, including attendee records, none of which OVH can read | Stored in France; remote technical support may be carried out from within the European Union and from Canada and the United Kingdom | None needed; Canada and the United Kingdom are covered by European Commission adequacy decisions |
| Sendinblue SAS (Brevo) | Email delivery | The account holder’s and helpers’ email addresses, and the content of the messages we send them | Established in France; data hosted in the European Union | None needed |
| Stripe Payments Europe, Limited | Payments | Billing and subscription data only | Established in Ireland; processing in the United States and certain regulated data in India | EU–U.S. Data Privacy Framework and standard contractual clauses |
Attendee data is stored in France and is not transferred outside the European Union. No attendee data reaches Stripe or the email service, so the transfers outside the European Union concern your billing data only.
No sub-processor can read an attendee’s name, contact details, birthday (day and month, without year) or written message. The hosting provider does hold, in readable form, the fact that an organisation exists, when it meets and how many opaque identifiers attended.
Before adding or replacing a sub-processor we give you at least 30 days’ notice by email, and you may object on reasonable data protection grounds within that period, as set out in the Data Processing Agreement (Contrato de encargado del tratamiento).
Other recipients of account data
We must disclose your account data to the Spanish tax authority, to a supervisory authority or to a court where the law requires it, and in those cases we may not be free to tell you first. Apart from the sub-processors above, there are no other recipients of your account data.