Sub-processors

When you send us messages intended for natural persons, you are the controller and we are your processor under art. 28 GDPR: we process that data on your behalf and on your instructions.

To provide that service we in turn rely on providers of our own — a host, a payment provider. Those providers are sub-processors: they process part of the data, on our behalf, under the obligations we impose on them by contract. Art. 28 GDPR requires us to disclose them to you and to let you object to any addition or replacement.

OVH SAS hosts the entire service: the Kubernetes cluster running the application, the PostgreSQL database and the sending servers smtp.sporee.fr and smtp2.sporee.fr. The following data therefore resides on its infrastructure:

• your message content, including attachments;
• your recipients' email addresses and the associated display name;
• SMTP delivery logs, bounce reasons and suppression lists;
• your account data: email address, declared domains, API keys, technical access logs.

Mollie B.V. handles payment processing and receives only your account's billing data. No message content and no recipient address is transmitted to it. No card data passes through or is stored on our servers.

Both sub-processors are established in the European Union: OVH SAS in France, Mollie B.V. in the Netherlands. Using these sub-processors involves no transfer of personal data outside the European Union.

Your recipients' addresses, your message content and delivery logs are processed and stored exclusively in France, at OVH SAS.

Scaleway SAS — 8 rue de la Ville-l'Évêque, 75008 Paris, France — provides the container image registry and the technical secrets manager for the service. Those services process no personal data of customers or recipients: they hold only application images and technical credentials.

Scaleway SAS is therefore not a sub-processor within the meaning of art. 28 GDPR. It is disclosed in the legal notice for infrastructure transparency.

You give general authorisation to the sub-processors listed above. We will inform you by email of any addition or replacement at least thirty days before it is implemented; you may then object on legitimate grounds and, failing a solution, terminate free of charge.

This page is updated on every change. It is the up-to-date version of the list; the same list appears in article 5 of the data processing agreement.

For any question about sub-processors or data protection, write to contact@sporee.fr.

This English version is provided for information. The French version is the authoritative one and prevails in the event of any discrepancy.

• Data processing agreement (GDPR)
• Legal notice