Subprocessors

Last updated: 6 September 2026

This list identifies confirmed third parties that sajdoko:: may engage to process client personal data within an ordered service.

Scope of this list: it covers providers contracted or controlled by sajdoko:: for client-data processing. Providers selected and contracted directly by the client remain the client’s responsibility and are documented separately.

Current confirmed list

Subprocessors that may be used depending on project configuration
Provider Purpose Data Condition
Cloudflare, Inc. CDN, DNS, security, bot and attack protection IP addresses, HTTP requests, security identifiers and technical logs Only where sajdoko:: manages Cloudflare for the project
Google LLC – Google Analytics Usage measurement and analytics reporting Online identifiers and usage data configured by the client Only where analytics is included, authorised by the client and loaded after required consent
TikTok Pte. Ltd. – TikTok for Business Advertising measurement and conversion tracking Online identifiers, browser parameters and conversion events Only where advertising tracking is active and loaded after required visitor consent
OpenAI, LLC Conversion tracking, audience measurement and campaign attribution Online identifiers, browser parameters and conversion events Only where OpenAI tracking is active and loaded after required visitor consent

These providers operate internationally. Transfers and safeguards depend on the provider contract, project location and applicable law.

Hosting, email, backup and other providers

Hosting, domain, email/SMTP, backup, monitoring, licence and API providers vary by project. When the client contracts them directly, they are not sajdoko:: subprocessors. When we contract them and they process client data, their name, service and location are identified in the quote, DPA or project schedule before use.

The hosting provider for sajdoko::’s own website is cloudys.com. The SMTP provider still requires confirmation before production. These website providers are addressed in the Privacy Policy.

Notice of changes and objections

Where the general authorisation in the DPA applies, we notify the client in writing of a new or replacement subprocessor before it processes data. The client may object within the reasonable notice period by explaining a specific data-protection concern.

We work in good faith to find an alternative. If no reasonable alternative exists, either party may end only the affected service component under the project agreement.

Due diligence and obligations

Before engagement, we assess whether the provider is suitable for the service and impose contractual duties covering confidentiality, security, incidents, assistance, return/deletion and further subprocessors. sajdoko:: remains responsible to the client for its obligations under the DPA.

For a question about a specific project or provider, email [email protected].