Sub-processors
Last updated
This page lists the third parties that process personal data on behalf of LBREEZE LIMITED. It forms part of our Privacy Policy and of our Data Processing Addendum, and it is the list referred to in section 5 of that Addendum.
Every party below is engaged under a written contract that imposes data protection obligations no less protective than those we owe you, and we remain liable to you for what they do.
How to get notice of changes
We give at least 30 days' notice before adding or replacing a sub-processor. To receive that notice by email, write to privacy@lbreeze.com asking to be added to the sub-processor notification list. Customers who have objected to a change on reasonable data protection grounds, and for whom we cannot find an alternative, may terminate the affected service without penalty; section 5 of the Data Processing Addendum sets out how.
Current sub-processors
| Provider | What it does for us | Data it can reach | Location |
|---|---|---|---|
| Hetzner Online GmbH | Hosts the physical and virtual infrastructure our services and our customers' instances run on | Anything held in customer environments, at rest and in transit | Germany (EU) |
| Cloudflare, Inc. | Content delivery, authoritative and recursive DNS, and web application firewall in front of our public services | Request metadata, including IP addresses and user-agent strings | Global edge network |
| CentralNic Group (RRPproxy) | Registers, renews and transfers domains, submits registrant contacts to registries, and orders TLS certificates | Registrant, administrative, technical and billing contact details; domain and certificate technical data | United Kingdom and EU |
| MaxMind, Inc. | Resolves an IP address to an approximate location for fraud screening and tax determination | IP address at the moment of the lookup | United States |
| OpenAI, L.L.C. | Answers prompts originated from AI-assisted features | Only the content submitted to that feature by a staff member or a customer | EU |
| Anthropic PBC | Answers prompts originated from AI-assisted features | Only the content submitted to that feature by a staff member or a customer | EU |
A live, generated view of the infrastructure and AI sub-processors for our operations platform, including a link to each provider's own data processing agreement, is published at noc.lbreeze.com/legal/subprocessors.
A note on how this list is produced
We derive this list from the integrations actually enabled on our platform rather than maintaining it by hand, so that adding a payment gateway or a registrar cannot quietly add a data recipient that this page does not mention. When an integration changes, this page and our privacy documentation are re-reviewed.
Where a category of provider appears in our Privacy Policy but not in the table above, it is because we do not currently use one. We take payment without a third-party card processor, and we send transactional email from our own mail infrastructure. If that changes, this page changes first.
Not sub-processors
Some third parties receive data from us but are not our sub-processors, because they decide for themselves what to do with it. They are independent controllers, and their own policies apply:
- Domain registries. A registry receives registrant details because its own rules require it, and publishes what its policy says to publish. Neither we nor our registrar controls that. See section 8 of our Privacy Policy.
- Certificate authorities, where they act as controller for validation and revocation records, and where issuance is logged to public Certificate Transparency logs.
- Banks and card schemes, which process payment data under their own obligations.
- Professional advisers, regulators, courts and law enforcement, where we are required or permitted to disclose.