# DPA & sub-processors

## Data processing agreement (DPA)

If your company uses Kalender Sync for work, you conclude a **DPA under Art. 28 GDPR** with us. On the **Professional plan the DPA is included**; on Free and Basic it's available **on request**:

→ Email [support@kalender-sync.de](mailto:support@kalender-sync.de) with your company name and address — you'll receive the DPA back for signature.

## Sub-processors

We use these service providers to deliver the service:

| Provider | Purpose | Location | Basis |
| --- | --- | --- | --- |
| Hetzner Online GmbH | Hosting (servers, database) | Falkenstein, DE | DPA under Art. 28 GDPR |
| Lettermint B.V. | Transactional emails & service notifications (sent via mail.kalender-sync.de) | Netherlands, EU (EU-only infrastructure) | DPA under Art. 28 GDPR |
| Brevo (Sendinblue SAS) | Marketing & onboarding emails (transactional during migration) | France, EU | DPA under Art. 28 GDPR |
| Google Ireland Ltd. | Google Calendar API | EU + USA (EU-US DPF) | Google Data Processing Addendum |
| Microsoft Ireland Operations Ltd. | Microsoft Graph API | EU + USA (EU-US DPF, SCCs) | Microsoft Online Services DPA |
| Stripe Payments Europe Ltd. | Payment processing (subscriptions) | Ireland, EU | Stripe DPA |

Google and Microsoft act as **transmission paths on the user's behalf**: calendar data only flows between your own accounts — not to third parties.

## Authoritative sources

- [Privacy policy](https://kalender-sync.de/en/privacy-policy/) — the legally binding version incl. the current sub-processor list
- [IT admin page](https://kalender-sync.de/it-admin/) — compact overview for compliance reviews (scopes, admin consent, hosting)