Sub-processors
Annex 2 to the data processing agreement. Georg Flossmann, trading as “leanframe”, Ickelsamerstraße 35, 81825 Munich, Germany. Version of 1 November 2026.
This English version is provided for information only. The German version is legally binding.
leanframe uses these companies to process data on behalf of the customer. We announce changes by email at least four weeks in advance.
| Company | Service | Data | Place of processing | Legal basis |
|---|---|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Servers, database, encrypted backups | all data in leanframe | Data centres in Germany and Finland (EU) | DPA under Art. 28 GDPR |
| Scaleway SAS, 8 rue de la Ville l'Evêque, 75008 Paris, France | Sending emails (confirmations, reminders, sign-in); nightly copy of the encrypted backups (Object Storage, Paris region) | for emails: recipient name and email address, email content, delivery status; for the backup copy: all data in leanframe, already encrypted with AES-256 before transfer (only leanframe holds the key) | France (EU) | DPA under Art. 28 GDPR |
| Anthropic (Anthropic, PBC, San Francisco, USA) | AI language model for the booking chat and the portal assistant | Content of conversations and emails and the appointment and customer data needed for the answer; never confidential questionnaire answers (Art. 9 GDPR) | USA | DPA under Art. 28 GDPR; EU standard contractual clauses or EU-US Data Privacy Framework; data not used for training |
Services that are not sub-processors
| Service | Why it is not a sub-processor |
|---|---|
| The customer’s calendar provider (Google, Microsoft, Apple iCloud) | Only connected if the customer sets it up. The calendar belongs to the customer’s account; the provider processes the data under the contract between the customer and the provider. |
| The customer’s address book provider (Google, Microsoft, Apple iCloud) | Only if the customer switches on “Customers in your address book” themselves. The address book belongs to the customer’s account; leanframe writes the name, phone number, email address and a note of the customer’s end customers there on the customer’s instructions. The provider processes the contacts under the contract between the customer and the provider (recipient on the customer’s instructions). |
| The customer’s email provider (e.g. Google, Microsoft, IONOS, GMX) | The mailbox belongs to the customer; leanframe only fetches it on the customer’s behalf. The provider processes the emails under the contract between the customer and the provider. |
| Recipients of webhooks and exports | The customer chooses the addresses and files (e.g. their CRM, Zapier, Make, n8n, accounting). Data is transferred on the customer’s instructions to parties the customer has its own contract with. |
| Stripe (Stripe Payments Europe, Ltd., Ireland) | Billing of plans. Only processes the customer’s billing data, for which leanframe is itself the controller; no end-customer data. |