Stripe Payments Europe, Limited
processor or independent controller depending on the specific payment activity
Payments, billing and subscriptions; without the content of e-invoices delivered through Peppol.
List of subprocessors
Current public list of services that process personal data on behalf of Kaja Solutions when ePošťák is operated. Not every subprocessor is used for every customer or feature.
| Supplier / flow | When used | Purpose and data | Location and transfer |
|---|---|---|---|
| netcup GmbH | standard operation | Hosting of the application, database and Peppol access point. Accounts, company data, e-invoices, attachments, transport and technical data. | Germany and Austria (EU). |
| Contabo GmbH | standard operation | Backups, monitoring and e-mail sending. Backups; for email, addresses, notice content and delivery metadata. | France (EU). |
| Functional Software, Inc. d/b/a Sentry | standard operation | Error and performance monitoring and technical diagnostics. Technical request and error data, kept for 30 days. Invoice content is not sent to the service. | Data ingestion in Germany (EU); limited access from the United States under the EU-US Data Privacy Framework and standard contractual clauses (SCC). |
| Google Cloud EMEA Limited (Gemini API) | optional feature | Reading data from a photo, PDF or receipt in the mobile app, the web interface or through the API (Invoice from PDF), only when the user uses that function. The submitted document or image and data required to extract invoice fields. The supplier does not use them to train models and keeps them only for a limited time to detect abuse. | Processing may also take place outside the EEA; the transfer is governed by the Google Cloud Data Processing Addendum and standard contractual clauses (SCC) or the EU-US Data Privacy Framework. |
| OpenAI Ireland Limited | optional feature | Reading bank statements, AI assistant and automatic payment matching, only when the user uses the relevant function. Input, context and output submitted to the specific function. The supplier does not use them to train models and may keep them for at most 30 days to detect abuse. | Processing may also take place outside the EEA; the transfer is governed by the OpenAI data processing addendum and standard contractual clauses (SCC). |
| Apple Inc. (Apple Push Notification service) | optional feature | Delivering notifications to the ePošťák iPhone app, only when the user allows them in the app. The device notification identifier and the notification text, for example a company name and the number of new documents; document content is not sent. | United States; the transfer is governed by the EU-US Data Privacy Framework or standard contractual clauses (SCC) under Apple's terms. |
Ordinary sending and receiving of e-invoices does not send document content to Gemini or OpenAI. These services are engaged only when the labelled optional feature is used.
Services with a different role
These services may receive limited data but are not part of the standard Article 28 GDPR e-invoice processing chain.
Google Ireland Limited (Google Analytics)
analytics service used only after consent to analytics cookies
Public-page usage, device and browser data; signed-in interfaces and e-invoice content are excluded from measurement.
The Slovak Financial Administration, OpenPeppol, the state SMP directory technically operated by Ionite B.V. for the Slovak Financial Administration, in which all access point providers register participants, other Peppol access points, the recipient's access point and the business recipient are not Kaja subprocessors because they perform their own statutory or network role in delivery.