Our processors

1. What a processor is

This page belongs with our privacy policy. That document covers what data we process and why; this one names the suppliers involved in doing so.

A processorA supplier that handles data on our behalf and only for what we ask, such as a hosting or mail provider. is a supplier that processes personal data on our behalf. It may only do what we ask, may not use the data for its own purposes, and is contractually bound by a data processing agreementA contract with a supplier setting out what it may and may not do with your data..

In that arrangement we remain the controllerThe organisation that decides why and how personal data gets used, and is answerable for it.: you come to us, not to the supplier. Where a party determines its own purposes, we say so explicitly below, because its own policy then applies to that part.

2. How we choose suppliers

We do not add a service simply because it is convenient. Before a party joins this list, we look at:

• whether we can solve the problem without an external party at all, because the shortest chain is always the safest
• what data that party actually gets to see, and whether it can be kept to a minimum
• where the data is stored and processed
• whether there is a solid data processing agreement, and what it says about sub-processors
• how the party handles security, incidents, and deleting data once the work is done

The same applies to the parties our suppliers engage in turn. They may only do so under the same obligations we impose, so the protection does not thin out at every link.

3. Who we use today

These are the parties that process personal data today for this website, our mailboxes and our products.

Google Cloud

Hosting and infrastructure for this website and our products: the servers, the storage and the network that delivers the pages. Processes technical data such as IP addresses in server logs. Google Cloud EMEA Limited, Ireland, with storage in European regions.

Google Workspace

Our mailboxes, calendar and documents. Every message you send us, and every message we send, passes through here. Google Ireland Limited, Ireland.

Cloudflare

The domain name system for punfyre.be: it translates our domain name into the server's address. It sees the visitor's IP address in doing so, but not the content of your visit. Cloudflare, Inc., processing in European data centres.

Odoo

Our business administration: quotes, invoices and the customer records that go with them. It therefore processes customers' contact and billing details. Odoo S.A., Belgium.

Mollie

Payments, where a product sells something or offers a subscription. For the legal duties resting on a payment institution, such as fraud prevention, Mollie is an independent controller and its own policy applies. Mollie B.V., the Netherlands.

MessageBird

Sends the messages Alarmira alerts with, such as an SMS when an alarm goes off. It receives the recipient's phone number and the content of the message to do so. MessageBird B.V., the Netherlands.

Securitas Alert Services

The licensed alarm centre behind Alarmira: it follows up alarms and dispatches help. It receives only the data an intervention needs, such as your address and your emergency contacts. For that follow-up Securitas is an independent controller and its own privacy statement applies. Securitas Alert Services NV, Belgium.

We never sell, rent or trade your data. No party on this list gains access in exchange for money or other benefits.

4. Where your data sits

Our data sits within the European Economic Area. Where a supplier also operates outside the EEA, we select the European region and record that contractually.

If a transfer outside the EEA is unavoidable after all, it happens only on a valid basis: an adequacy decision by the European Commission, or the standard contractual clauses under the GDPR framework, together with the additional measures needed.

Support happens from Belgium. Where we need access to data to resolve a problem, that access stays limited to what solving it requires.

5. Changes to this list

This list is a snapshot. When we start using a new party, or stop using one, we update this page and the date at the top moves with it.

Where a change genuinely alters how your data is processed, we note it in our privacy policy as well, so you do not have to discover it by comparing two versions of this page.