Version 1.0 · 30 September 2026
If this English text and the Dutch version differ, the Dutch version prevails.
What this list is
YouthCommerce (PhiFlow) processes customers' personal data as a processor. In doing so we engage other parties, called sub-processors. This list is Annex 3 to the data processing agreement. For each party it states the service, the location of processing and the safeguard for transfers outside the European Economic Area (EEA).
Changes
We notify you of a proposed addition or replacement of a sub-processor at least 30 days before the effective date. We do so by email to the customer's contact person and by updating this page. The customer can object within 14 days. The data processing agreement regulates what happens then, including the right to terminate the service concerned. In an urgent case, for example a security risk, the period may be shorter; we will then notify you immediately.
Core: for all customers
| Party | Service | Location of processing | Transfer safeguard |
|---|---|---|---|
| Supabase (Supabase Pte. Ltd., Singapore) | Database, authentication and file storage | EU (Ireland) | Standard contractual clauses (SCCs), with UK Addendum and Swiss adaptations |
| Vercel Inc. | Hosting of the application and server functions | EU (Frankfurt); requests are routed via Vercel's global network | EU-US Data Privacy Framework (DPF), incl. UK and Switzerland; SCCs |
| Google Cloud EMEA Ltd. (Google Cloud) | Data storage, processing and backups | EU (European multi-region and Belgium) | DPF (Google LLC), incl. UK and Switzerland; SCCs |
| OpenAI Ireland Ltd. (processing by OpenAI OpCo LLC) | AI processing with language models | United States | SCCs, with UK Addendum. Data is not used for training. The supplier retains data for a maximum of 30 days for abuse monitoring |
| Sinch Mailjet SAS | Sending email from the platform, such as invitations, sign-in emails and notifications (tracking disabled) | EU (France and Belgium) | Not applicable (processing within the EEA) |
Per module: only when activated by the customer
| Party | Service | Module | Location of processing | Transfer safeguard |
|---|---|---|---|---|
| Cloudflare Inc. | Receiving and routing incoming email | Incoming email | Global network | DPF, incl. UK and Switzerland; SCCs |
Not sub-processors
Services the customer connects itself. Advertising, analytics, CRM, recording, outreach and communication platforms that the customer connects to PhiFlow itself are not sub-processors of YouthCommerce. The customer has its own relationship with those parties and often its own account. PhiFlow retrieves data from them on the customer's instruction. PhiFlow only sends conversion data to them if the customer instructs it to do so and has recorded consent and a legal basis. If that data goes to a country outside the EEA, the customer is responsible for this.
Services without personal data from customer data. Some features use services that do not receive personal data from customer data, such as public data sources. They are therefore not sub-processors.
Jurisdiction and international access (Data Act, article 28)
Location. Customer data is stored in the EU. Processing with language models takes place in the United States. Requests to the platform are routed via our hosting provider's global network.
Non-European parties. Some sub-processors are US or other non-European companies, or have a parent company outside the EU. They may therefore be subject to foreign legislation, even if the data is located in the EU. In theory, they may receive a request from a non-European government to provide data.
Safeguards.
- Transfers outside the EEA only take place with an adequacy decision, such as the EU-US Data Privacy Framework, or with the European Commission's model contract clauses, supplemented with additional measures where necessary.
- Data is encrypted in transit and at rest.
- The model contract clauses oblige a recipient to report a government request and to challenge an unlawful request. Some of our suppliers have also included this in their own data processing agreement.
- If we receive a request ourselves, we will report it to the customer to the extent the law allows.
- We only transfer data that is necessary for the service.
This section describes the situation on the date stated above. Questions: [email protected].
Version
| Version | Date | Change |
|---|---|---|
| 0.1 | 2026-09-29 | First draft |
| 1.0 | 2026-09-30 | Locations and safeguards verified; first publication |