Sub-processors
Sub-processors engaged by SWAPTO GmbH
SWAPTO GmbH (“SWAPTO”) uses a limited number of carefully selected sub-processors to provide its real‑time tele‑translation services and related support, billing, and security functions. This page provides an overview of the current sub-processors engaged by SWAPTO, including their role, location of processing, and (where applicable) international transfer mechanisms. For customers, this page forms part of the information SWAPTO provides under its Data Processing Agreement (DPA) and, where agreed, constitutes the Live Sub‑Processor List referred to in the DPA and in Annex III of the EU Standard Contractual Clauses (SCCs). Updates to this page are notified and governed in accordance with the DPA (in particular the sub‑processor clause and the Contract Change Control Process).
1. Current sub-processors
The following subprocessors are currently engaged by SWAPTO in connection with the provision, operation, and support of its service:
Sub-processor | Registered address | Service provided | Location of processing | Transfer mechanism | DPA |
|---|---|---|---|---|---|
Amazon Web Services EMEA SARL | 38 Avenue John F. Kennedy, L-1855 Luxembourg | Speech-to-text, text-to-speech, and machine translation processing (in transit) | EU data residency configured | Standard Contractual Clauses per AWS DPA | Yes |
Anthropic, PBC | 548 Market Street, PMB 90375, San Francisco, CA 94104, USA | AI language model API (in transit) | United States | Standard Contractual Clauses; EU–US Data Privacy Framework where applicable | Yes |
DeepL SE | Maarweg 165, 50825 Cologne, Germany | Machine translation of text (in transit) | European Union | N/A — EEA processing under current contract | Yes |
ElevenLabs, Inc. | 169 Madison Avenue, #2484, New York, NY 10016, USA | Voice synthesis (text-to-speech, in transit) | United States | Standard Contractual Clauses; EU–US Data Privacy Framework where applicable | Yes |
Google Ireland Limited | Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland | Speech-to-text, text-to-speech, and machine translation processing (in transit) | EU data residency configured | Standard Contractual Clauses per Google Cloud DPA | Yes |
Hetzner Online GmbH | Industriestraße 25, 91710 Gunzenhausen, Germany | Infrastructure hosting | Germany (Nuremberg) | N/A — EEA only | Yes |
Heylogin GmbH | Hopfengarten 18A, 38102 Braunschweig, Germany | Operational secrets management | Germany | N/A — EEA only | Yes |
HubSpot, Inc. | 2 Canal Park, Cambridge, MA 02141, USA | Customer relationship management (sales pipeline) | United States | Standard Contractual Clauses; EU–US Data Privacy Framework where applicable | Yes |
Mailjet SAS (Sinch group) | 13–13 bis Rue de l'Aubrac, 75012 Paris, France | Transactional email delivery (in transit) | European Union (France / Germany) | N/A — EEA only | Yes |
Microsoft Ireland Operations Ltd
(Azure AI Speech) | One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland | Speech-to-text and text-to-speech processing, and machine translation processing (in transit) | EU data residency configured; international sub-processing may occur per Microsoft DPA | Standard Contractual Clauses per Microsoft Products and Services DPA (aka.ms/dpa) | Yes |
Microsoft Ireland Operations Ltd
(Microsoft 365) | One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland | Business communications and internal document storage | EU data residency configured | Standard Contractual Clauses per Microsoft Products and Services DPA | Yes |
Stripe Payments Europe Ltd | 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, D02 H210, Ireland | Billing and payment processing | Ireland (EEA), with possible US sub-processing | Standard Contractual Clauses per Stripe DPA | Yes |
Twilio Ireland Limited | 25–28 North Wall Quay, Dublin 1, D01 H104, Ireland | Telephony (voice carriage) | EU primary; may transit or fail over via the US | EU–US Data Privacy Framework and/or Standard Contractual Clauses (per Twilio DPA) | Yes |
Wix.com Ltd | Verify EU contracting entity from DPA | Public website hosting | International (per Wix DPA) | Standard Contractual Clauses per Wix DPA | Yes |
2. Change notification and customer rights
SWAPTO may appoint new subprocessors or replace existing ones from time to time.
Publication and advance notice
– SWAPTO maintains this Live Sub‑Processor List at https://www.swapto.tech/legal/subprocessors.
– Any intended addition or replacement of a subprocessor is announced at least 30 days in advance by updating this page and, where applicable, by separate notification (e.g. via email or customer portal), as set out in the DPA.
Customer objection and special termination rights
– Customers may object in writing to an intended change on reasonable, data‑protection‑related grounds within the objection period specified in the DPA (typically 30 days from notification).
– In such case, SWAPTO and the customer will work together in good faith to find a commercially and technically reasonable solution.
– If no acceptable solution can be agreed, the customer may exercise its special termination right for the affected services as described in the DPA, without penalty.
If no written objection is received within the applicable objection period, the change is deemed accepted.
3. Data protection and international transfers
All subprocessors listed on this page are bound by written data processing agreements with SWAPTO that meet the requirements of Art. 28 GDPR, including obligations on confidentiality, security, assistance with data subject rights, and deletion/return of data. SWAPTO remains fully responsible towards its customers for the performance of its subprocessors.
Where subprocessors process personal data in countries outside the EU/EEA, SWAPTO ensures that appropriate safeguards under Chapter V GDPR are in place, such as:
-
adequacy decisions (Art. 45 GDPR),
-
Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), and
-
supplementary technical and organisational measures (e.g. encryption in transit and at rest, strict access control, logging and vendor due diligence), as described in SWAPTO’s DPA and Technical and Organisational Measures.
4. Versioning, history and contact
Last updated: 07.06.2026
SWAPTO keeps internal records of all changes to this Live Sub‑Processor List, including the date of each addition or replacement and the identity of the affected subprocessors. On written request and subject to confidentiality, SWAPTO will provide customers with an overview of the change history for audit and compliance purposes, as described in the DPA and SWAPTO’s Contract Change Control Process.
For questions relating to this list or data protection in general, please contact:
– Email : legal@swapto.tech
– Postal address: SWAPTO GmbH, Fulerumer Straße 164, 45149 Essen, Germany