Subprocessors of Wikando GmbH

The data processor commissions the following companies as subprocessors:

Amazon Web Services

Amazon Web Services Deutschland GmbH

Krausenstr. 38
10117 Berlin
Germany

Object of processing: Hosting, storage, and monitoring of the SaaS application FundraisingBox.

Data processed or stored:

Billing Data	Membership Contributions
Address Data	Last Name
Age	User ID
Salutation	Username
Address	Usage Data
Display Name	Password
Bank Details	PayPal Payer ID
Bank Account Data	Profile Picture
User IDs	Profile Data
Username	Project Data
User Profiles	Log Data
Images	Registration Date
File Attachments	Donation Receipts
File Transfer	Donation Details
Date and Time of Query	Language
Documents	Master Data
Email Address	Phone Number
Error Codes	Text Inputs
Activation Date	Title
Date of Birth	Transaction Details
Gender	Revenue
History	VAT ID
ID Number	Club Name
Content of the Query	Club Profile
Content Data	Club Membership
IP Address	Contract Billing Data
Card Expiration Date	Contract Data
Communication	First Name
Communication Data	Payment Data
Contact Data	Payment Terms
Account Data	Time
Credit Card Holder	Time Zone
Performance and Utilization Metrics	Access Status / HTTP Status
Log Data	Access Times
Metadata

Nature of processing: Processing consists of all data processing activities carried out by the controllers instructions, which are necessary to provide the services to the controller and for the purposes set out in the standard contractual clauses.

Duration of processing: The duration of processing is limited to the period necessary to fulfill the obligations arising from the main contract unless there is a legal obligation.

Storage location of the data: Germany

You can find more information on data protection from Amazon Web Services here:

Compliance Information: https://aws.amazon.com/de/compliance/
Information on IT Security and Data Protection: https://aws.amazon.com/de/security
GDPR Information: https://aws.amazon.com/de/compliance/gdpr-center/

Asana

Asana Deutschland GmbH

Neuturmstraße 5
80331 Munich

Germany

E-Mail: privacy@asana.com, dpo@asana.com

Object of processing: project management, product management, and work management

Data processed or stored:

User IDs
Email address
Protocol data
Transaction IDs
Transaction details

Nature of the processing: Processing consists of all data processing activities carried out by the controllers instructions, which are necessary to provide the services to the controller and for the purposes set out in the standard contractual clauses.

Duration of processing: The duration of processing is limited to the period necessary to fulfill the obligations arising from the main contract unless there is a legal obligation.

Storage location of the data: Germany and the European Economic Area

Further information on Asana’s data protection can be found here:
https://asana.com/de/terms#terms-of-service
https://asana.com/de/security-standards

Elasticsearch B.V.

elasticsearch BV
Keizersgracht 281
1016 ED Amsterdam
Netherlands

Phone: +31 207 947 300
Email: emea-workplace@elastic.co

Subject of Processing: Storage and processing of log data, automated detection of errors and anomalies.

Processed or stored data: All data that is also stored on Amazon AWS.

Nature of the processing: Processing consists of all data processing activities carried out by the controllers instructions, which are necessary to provide the services to the controller and for the purposes set out in the standard contractual clauses.

Duration of processing: The duration of processing is limited to the period necessary to fulfill the obligations arising from the main contract unless there is a legal obligation.

Storage location of the data: Germany and European Economic Area

For more information about data protection at Elastic.co, click here:

https://www.elastic.co/de/security-and-compliance/

Fivetran

Fivetran Inc.
1221 Broadway Street
Suite 2400 Oakland
CA 94612

USA

E-Mail: dpo@fivetran.com

Object of processing: Fivetran is an automated data integration platform that allows us to transfer data from a variety of sources into our data platform. It also supports compliance with data protection standards by ensuring that all data is processed in a compliant and consistent manner.

Processed or stored data: All data that is also stored on Amazon AWS.

Nature of processing: Processing consists of all data processing activities carried out by the controllers instructions, which are necessary to provide the services to the controller and for the purposes set out in the standard contractual clauses.

Duration of processing: The duration of processing is limited to the period necessary to fulfill the obligations arising from the main contract unless there is a legal obligation.

Storage location of the data: Germany and European Economic Area

Further information on data protection at Fivetran can be found here:

https://www.fivetran.com/de/legal#privacy-policy

Freshworks

Freshworks GmbH

Neue Grünstraße 17
10179 Berlin

Germany

Phone: +4930 58849246
Email: support@freshworks.com

Object of processing: Ticket creation and processing, key accounting

Processed or stored data: All data you provide to us during ticket creation and processing.

Nature of processing: Processing consists of all data processing activities carried out by the controllers instructions, which are necessary to provide the services to the controller and for the purposes set out in the standard contractual clauses.

Duration of processing: The duration of processing is limited to the period necessary to fulfill the obligations arising from the main contract unless there is a legal obligation.

Storage location of the data: Germany and the European Economic Area

Further information on Freshworks’ data protection can be found here:
https://www.freshworks.com/gdpr/
https://www.freshworks.com/security/

Google

Google Ireland Limited

Gordon House, Barrow Street
Dublin 4
Ireland

E-Mail: support-deutschland@google.com

Object of processing: Use as a document management system

Nature of processing: Processing consists of all data processing activities carried out by the controllers instructions, which are necessary to provide the services to the controller and for the purposes set out in the standard contractual clauses.

Duration of processing: The duration of processing is limited to the period necessary to fulfill the obligations arising from the main contract unless there is a legal obligation.

Storage location of the data: European Economic Area

For more information on Google’s privacy policy, click here:
https://cloud.google.com/privacy/gdpr
https://support.google.com/googlecloud/Datenschutz
https://support.google.com/googlecloud/sicherheit
https://support.google.com/compliance

Heyflow GmbH

Jungfernstieg 49, 20354 Hamburg, Germany

Subject of Processing: Heyflow is a tool for creating interactive funnels, enabling the design of user-friendly and engaging forms and processes. With Heyflow, user interactions can be better controlled and analyzed, leading to an improved user experience and more effective data processing.

Processed and/or Stored Data:
Address data
Bank details
Bank account data
User IDs
Account data
Master data

Type of Processing: Processing includes the collection, storage, and analysis of user data according to customer instructions and for the purposes defined in the agreement.
Duration of Processing: The duration of processing is limited to the time necessary to fulfill the obligations of the main contract, unless there is a legal obligation for longer retention.

Data Storage Location: Germany and European Economic Area

For more information on Heyflow’s privacy policy, click here:
https://heyflow.com/de/datenschutz/

Joincube, Inc. (Beamer)

3500 South Dupont Highway, Dover, DE 19901
Email: info@getbeamer.com

Subject of Processing: Provision of in-app product news/newsfeed, notifications (Notification Center), and associated interaction analysis within the FundraisingBox application.

Note: Only data from FundraisingBox users (customer organizations and their employees) are processed. Donor data is not affected.

Processed and/or Stored Data (Default):

User ID
Name
Email address
Organization ID
Organization Name
Plan/Subscription
Language
Role (e.g., Admin/User)
User creation date
Organization creation date
Used Features / Usage Events
IP Address

Type of Processing: Display of product updates/notifications and evaluation of interactions with this content.

Duration of Processing: Limited to the duration of contractual service provision, unless there is a legal obligation to the contrary.

Data Storage Location: EU – Beamer operates its services on the Google Cloud Platform

Further information on Beamer’s data protection and security can be found here:

Kestra Technologies SAS

5 Rue de la Terrasse, 75017 Paris, France

Subject of Processing: Kestra is a platform for orchestrating data processing processes (data workflows) that operates in the cloud. It is used for automating and controlling complex data flows, including those where personal data is processed. The platform processes personal data exclusively temporarily within the scope of the respective workflow execution, without permanently storing it.

Processed and/or Stored Data:
All data that is also stored on Amazon AWS. No persistent storage of personal data occurs in Kestra; processing is exclusively temporary within the scope of workflow execution.

Nature of processing: Processing consists of all data processing activities carried out by the controllers instructions, which are necessary to provide the services to the controller and for the purposes set out in the standard contractual clauses.

Duration of Processing: The duration of processing is limited to the period required for the fulfillment of obligations under the main contract, unless there is a legal obligation.

Data Storage Location: Belgium

Further information on data protection:

https://kestra.io/privacy-policy

Make.Com LLC by Celonis Inc.

123 Main Street, San Francisco, CA, 94105 USA

Subject of Processing: Make.com is an automation platform that allows connecting various apps and services and efficiently automating workflows. With Make.com, data from various sources can be integrated and synchronized to improve the efficiency and accuracy of processes. This leads to optimized data processing and contributes to improving the functionality of FundraisingBox.

Processed and/or Stored Data:
Address data
Bank details
Bank account data
User IDs
Account data
Master data

Type of Processing: Processing includes all data processing activities carried out according to customer instructions and necessary for providing services to the customer and for the purposes defined in the agreement.

Duration of Processing: The duration of processing is limited to the time necessary to fulfill the obligations of the main contract, unless there is a legal obligation for longer retention.

Data location: European Economic Area and Switzerland
More information on privacy:

https://www.make.com/en/security

https://www.make.com/en/privacy-notice

MaxMind

MaxMind, Inc. Legal department
51 Pleasant Street # 1020 Malden
MA 02148
USA

EMail: legal@maxmind.com

Object of processing: MaxMind is a tool to supplement IP addresses with additional information such as continent, country, and provider.

Nature of processing: Processing consists of all data processing activities carried out by the controllers instructions, which are necessary to provide the services to the controller and for the purposes set out in the standard contractual clauses.

Duration of processing: The duration of processing is limited to the period necessary to fulfill the obligations arising from the main contract unless there is a legal obligation.

Storage location of the data: USA

For more information about data protection at MaxMind, click here:

https://www.maxmind.com/en/privacy-policy

Mixpanel, Inc.

Address: 405 Howard St, San Francisco, CA 94105, USA
Email: compliance@mixpanel.com

Subject of Processing: Provision of product & usage analytics within the FundraisingBox application as well as associated interaction evaluations.

Note: Only data from FundraisingBox users (customer organizations and their employees) are processed. Donor data is not affected.

Processed and/or Stored Data (Default):

User ID
Name
Email address
Organization ID
Organization Name
Plan/Subscription
Language
Role (e.g., Admin/User)
User creation date
Organization creation date
Used Features / Usage Events
IP Address

Type of Processing: Collection and evaluation of usage events (events) as well as presentation of aggregated analyses (e.g., funnels, retention, segments/cohorts).

Duration of Processing: Limited to the duration of contractual service provision, unless there is a legal obligation to the contrary.

Data Storage Location: EU

Further information on Mixpanel’s data protection and security can be found here:

Sentry Functional Software, Inc.
45 Fremont Street, 8th Floor
San Francisco, CA 94105, USA

Subject Matter of the Processing:
Sentry is a monitoring and error analysis platform used to oversee the technical stability and security of web applications. The tool serves to identify, analyze, and resolve software errors as well as to optimize system performance. This ensures the functionality, security, and continuous improvement of the platform.

Processed and/or Stored Data:

General browser information
Timestamps
Error messages and error logs
URL of the embedded form

Personal data is excluded prior to transmission.

Nature of the Processing:
The processing includes the collection, transmission, storage, and analysis of technical usage and error data to ensure the stability, security, and proper functioning of the application. The processing is carried out exclusively within the framework of data processing pursuant to Art. 28 GDPR and based on documented instructions from the controller.

Duration of the Processing:
The duration of processing is limited to the term of the main contract as well as the respective retention period defined within the Sentry configuration. Log and error data are regularly deleted automatically and removed after the defined retention periods expire.

Location of Data Storage:
European Economic Area (EEA).

Further information on data protection:
https://sentry.io/privacy/

Snowflake

Snowflake Computing Netherlands BV

FOZ Building

Gustav Mahlerlaan 300-314

1082 ME Amsterdam

The Netherlands

E-Mail: privacy@snowflake.com

Object of processing: Snowflake is a cloud-based data platform that helps us to store data in a high-performance, secure and scalable manner and to process it with the aim of improving its analyzability and evaluability. This enables us to link data from different sources in order to gain valuable insights for the further development of the FundraisingBox and to increase the availability of data within the FundraisingBox.

Processed or stored data: All data that is also stored on Amazon AWS.

Nature of processing: Processing consists of all data processing activities carried out by the controllers instructions, which are necessary to provide the services to the controller and for the purposes set out in the standard contractual clauses.

Duration of processing: The duration of processing is limited to the period necessary to fulfill the obligations arising from the main contract unless there is a legal obligation.

Storage location of the data: Germany and European Economic Area

Further information on Snowflake’s data protection can be found here:

https://www.snowflake.com/snowflake-datenschutzhinweis/?lang=de

windata

windata GmbH

Weißgerberweg 11

88239 Wangen im Allgäu

Phone: +49 7522 9770-0
Email: info@windata.de, datenschutz@windata.de

Object of processing: Financial services for executing transactions and retrieving account balances.

Data processed or stored:

Address data
Bank details
Bank details
User IDs
Account details
Master data
Payment data

Nature of processing: Processing consists of all data processing activities carried out by the controllers instructions, which are necessary to provide the services to the controller and for the purposes set out in the standard contractual clauses.

Duration of processing: The duration of processing is limited to the period necessary to fulfill the obligations arising from the main contract unless there is a legal obligation.

Storage location of the data: Germany

For more information about data protection at windata, click here:

https://windata.de/site/Datenschutz.asp
Technical & organizational measures of windata