Sub-processors

1. Foundation facts

This is the canonical sub-processor list for Nose for Horse ("Nose"). The Privacy Policy, the DPA, and the Security & Trust page link here rather than duplicating the table.

• Operator / data controller (own data): DF Daniel Fojcik, a Polish sole proprietorship (jednoosobowa działalność gospodarcza, JDG) registered in CEIDG. NIP 6472592229 · EU VAT PL6472592229 · REGON 387798601. Principal place of business: ul. Goplany 36a, 44-321 Marklowice, Poland. Trading as Nose for Horse for this product.
• Legal / privacy contact: support@nose.horse. No formal Data Protection Officer is designated; the proprietor is the privacy contact.
• Supervisory authority: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, Poland — uodo.gov.pl.
• Two roles (see the Privacy Policy → “Who is responsible” and the DPA): controller — for marketing-site visitors, the account/billing data of barn admins & instructors, product analytics, and security/abuse-prevention data; processor — for the operational data a barn enters about its riders/customers (the barn is the controller; governed by the customer-facing DPA).
• Data residency posture (honest): Nose runs two data regions. Customer data for US-region barns is stored in the United States. The service is operated, administered and supported from the European Union. Every barn outside the US region is served from the EU region, where core processing runs in the EEA; a small set of services shared by both regions — transactional email, error monitoring, consent-gated analytics — stays in the EEA, and a few components run outside the EEA in both regions. The table below is the canonical record: each provider’s region, per data region, and the transfer mechanism covering it. It can change as we expand or as a provider changes its footprint; every cross-region route is covered by an appropriate mechanism — an adequacy decision, the EU-U.S. Data Privacy Framework (and its UK Extension), the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or the equivalent an added region requires (see the “Transfer mechanism” column).
• Retention posture: data is kept for the life of the active account; on rider erasure (Art. 17), direct identifiers are stripped after a 30-day grace (pseudonymization under Art. 4(5) GDPR — ride/financial lines retain a non-resolving pointer to the stripped profile, not full anonymization under Recital 26); on barn offboarding, data is retained max 90 days in an automated, reversible grace period, exported only on request, then deleted automatically. The 5-year tax-record duty is the barn’s (and Nose’s only for its own subscription invoices) — Nose does not hold rider personal data for 5 years. Full detail in the Privacy Policy → “How long we keep data (retention)” and the DPA → “Keeping, returning, and deleting your data”.
• Payments: Nose is never in the funds chain and never handles card data. Offline rider payments (cash / pass / voucher / transfer) remain tracking labels. Where a barn enables online payments, riders pay by card / wallet / (in Poland) BLIK through Stripe Connect straight into the barn’s own Stripe account — the barn is the merchant and Stripe is the payment processor; Nose only relays the instruction and never holds or receives the money. Subscription billing (a barn’s subscription to Nose) is live: Stripe bills Polish barns directly in PLN (Nose issues the PL faktura). Dodo Payments is the Merchant of Record for all non-Polish barns (EUR/GBP/USD) — Dodo is the legal seller of the subscription, issues the tax-compliant invoice/receipt, and calculates and remits VAT/sales tax in the destination jurisdiction. Both process the barn administrator’s billing-identity data on Nose’s behalf. As Merchant of Record, Dodo is more than a processor — it is an independent seller/controller for the transaction itself. Any future change to the billing providers follows the advance-notice and objection mechanics in the DPA → “Confidentiality, security, and sub-processors”.

2. Sub-processor master list

Each sub-processor receives only the data necessary to perform its function. "Region" is the data-processing region; several vendors are US-incorporated but offer EU data regions, so a DPA + SCC/DPF backstop covers any incidental access by the vendor entity. Nose runs two data regions; where a provider is deployed in both, the "Region" column names its instance in each, and a given barn is served only by its own region's instance.

3. Changes to this list

Change-of-sub-processor commitment: when Nose adds, replaces, or removes a sub-processor, it updates this list and notifies active barns — by email to the barn’s account address, or by an in-product notice shown to the barn’s administrators — at least 15 days in advance of the change taking effect (sooner only where urgent for security or service continuity), with a reasonable opportunity for the barn to object on data-protection grounds. The mechanics are set out in the DPA → “Confidentiality, security, and sub-processors”.

4. Processor-DPA register

Each vendor above publishes a standard Data Processing Addendum that applies via its Terms of Service or via in-console acceptance — none of them signs a bilateral wet-PDF DPA, and GDPR Art. 28(3) does not require one. Nose keeps an internal register with each vendor’s DPA URL, the version relied on, the acceptance mechanism, and the date last verified. That register is distinct from the customer-facing DPA (barn ↔ Nose).