Alla tredjeparts tjanster som behandlar personuppgifter pa HDS-plattformens vagnar, enligt GDPR artikel 28(3)(d).
All third-party services that process personal data on behalf of the HDS platform, pursuant to GDPR Article 28(3)(d).
Senast uppdaterad: 2026-08-12. HDS underrattar kommunen om andringar i denna lista med minst 14 dagars varsel.
| Underleverantor | Roll | Data som behandlas | Plats | Rattlig grund |
|---|---|---|---|---|
| Hetzner Online GmbH | Infrastrukturhosting (nuvarande) | All serverdata inklusive hela databasen (infrastrukturtillgang) | Helsingfors, Finland (EU) | Hetzners standardavtal for personuppgiftsbitrade |
| Kolo SE3 Pitea | Infrastrukturhosting (planerad) | All serverdata inklusive hela databasen (infrastrukturtillgang) — efter migrering | Pitea, Sverige (EU) | Avtal ej tecknat annu; migreringen sker sa snart en forsta kund ar signerad |
| Stripe Inc | Betalningshantering | Betalkortsdata (PCI-DSS-scope), betalningsbelopp, betalarens e-post | EU-servrar; Stripe foljer SCCs | Stripes standardavtal for personuppgiftsbitrade; SCCs for tredjelandsoverforing |
| Brevo (Sendinblue SAS) | E-postutskick (SMTP-relay) | Mottagarens e-postadress; utskickens innehall (systemmail, bokningsbekraftelser, losenordsaterstallning) | EU (Frankrike/Tyskland) | Brevos standardavtal for personuppgiftsbitrade |
Umami Analytics ar sjalvhostad pa HDS infrastruktur och behandlar inga personuppgifter. OpenStreetMap anvands enbart for kartvisning (klientside) och far inga personuppgifter fran HDS.
Last updated: 2026-08-12. HDS will notify the municipality of any changes to this list with at least 14 days notice.
| Subprocessor | Role | Data Processed | Location | Legal Basis |
|---|---|---|---|---|
| Hetzner Online GmbH | Infrastructure hosting (current) | All server data including the full database (infrastructure access) | Helsinki, Finland (EU) | Hetzner standard data processing agreement |
| Kolo SE3 Pitea | Infrastructure hosting (planned) | All server data including the full database (infrastructure access) — after migration | Pitea, Sweden (EU) | Agreement not yet signed; migration happens as soon as the first customer is signed |
| Stripe Inc | Payment processing | Payment card data (PCI-DSS scope), payment amount, payer email | EU servers; Stripe follows SCCs | Stripe standard data processing agreement; SCCs for third-country transfers |
| Brevo (Sendinblue SAS) | Email delivery (SMTP relay) | Recipient email address; email content (system mail, booking confirmations, password resets) | EU (France/Germany) | Brevo standard data processing agreement |
Umami Analytics is self-hosted on HDS infrastructure and processes no personal data. OpenStreetMap is used for map display (client-side only) and receives no personal data from HDS.