Subprocessors
Which service providers JASP uses for its apps (Room Booking, JASP Events, Virtual Office, Calendar, Tournament Prediction Game, Widget Builder): provider, location, purpose and data.
This list belongs to the Data Processing Agreement (DPA). It shows which service providers JASP Oldenburg & Henning PartG mbB (“JASP”) uses when JASP processes personal data for you. General information about our website is in the privacy policy. The German text is the binding one; the English text is a translation.
As of: 9 November 2026. We announce changes under section 6 of the DPA.
All apps
| Provider | Location | Purpose | Data | Apps |
|---|---|---|---|---|
| netcup GmbH | Karlsruhe, Germany; data centre Nuremberg | Servers for app, database and backups | all app data | all apps |
| Cloudflare, Inc. | San Francisco, USA; processing in its global network | Only route for app requests to the servers (tunnel, DNS, attack protection); in the Virtual Office also relay for audio and video (Cloudflare Realtime) | IP address and technical request data; in the Virtual Office media streams as an encrypted relay | all apps |
Individual apps only
| Provider | Location | Purpose | Data | Apps |
|---|---|---|---|---|
| Microsoft (Azure Communication Services) | Data location Europe; parent company Microsoft Corporation, USA | Sending e-mail (sign-in codes, confirmations, reminders) | e-mail address, name, content of the mail | Room Booking, JASP Events, Calendar, Tournament Prediction Game, Widget Builder |
| Microsoft (Microsoft Graph, Exchange Online in the customer’s tenant) | at the customer or Microsoft | Read and write bookings in the room mailboxes; optional Teams presence | bookings, subject, attendees; presence status | Room Booking, Virtual Office |
| GitHub, Inc. | San Francisco, USA | Storing feedback that users send through the feedback form | feedback text, display name, optional contact details (e-mail address or mobile number), technical details (page, browser, language, screen size) | Virtual Office |
| Anthropic PBC, as fallback Microsoft (Azure) | Anthropic: USA, processing worldwide; Microsoft: parent company in the USA | AI features in the Widget Builder; requests pass through an AI proxy that JASP operates itself | input in the AI chat, widget content | Widget Builder |
| OpenStreetMap Foundation (Nominatim) | United Kingdom | Address search (geocoding) | address search text, for a search by coordinates those coordinates; IP address of the browser or the JASP server | Widget Builder |
Operated by JASP itself
Error monitoring (GlitchTip), web statistics (Umami), logs, monitoring and the Widget Builder’s AI proxy run on systems that JASP operates itself, not with another provider. App logs are kept for 14 days. The additional backup of the databases outside the data centre sits on a backup system that JASP operates itself.
Not part of this DPA
- JASP Billing (customer portal, orders, invoices): here JASP processes data as a controller. sevDesk GmbH (invoices) acts as JASP’s processor, Mollie B.V. (payments), by its own statement, as an independent controller. Details are in the privacy policy.
- Staffbase, Google, Microsoft Entra as sign-in route: these are identity services of your organisation. You choose them; JASP only connects them.
- Azure Blob Storage in the Widget Builder: you set up your own backup there in the settings with your own Azure account. That provider is yours, not ours.
- API-Sports supplies match data for the Tournament Prediction Game. No personal data flows.
Third countries
Cloudflare, Microsoft, GitHub and Anthropic are based in, or have a parent company in, the USA. Cloudflare, Microsoft and GitHub are, by their own statement, certified under the EU-U.S. Data Privacy Framework; EU standard contractual clauses apply in addition. For Anthropic, the EU standard contractual clauses in its data processing addendum apply. For the United Kingdom (OpenStreetMap Foundation), an EU Commission adequacy decision applies (Art. 45 GDPR).
Questions and objections
Write to info@jasp.eu. How we announce changes and how you can object is in the DPA.