This is an English translation provided for convenience. In the event of any discrepancy, the Romanian version available at www.routena.com/subimputerniciti shall prevail.
This list presents the sub-processors that may process personal data on behalf of Routena, as Processor, for the provision of the Services. It supplements the Data Processing Agreement (DPA).
1. General authorization
By accepting the DPA, the Client grants Routena a general written authorization to use sub-processors for the provision of the Services. Routena imposes on each sub-processor the same data-protection obligations, to the extent applicable to the services entrusted, as those provided in the DPA, and remains responsible to the Client for their activity.
2. Current sub-processors
For transfers of personal data outside the EU/EEA, Routena ensures that an adequate transfer mechanism exists: an adequacy decision of the European Commission (including the EU-US Data Privacy Framework – where the provider is certified) or the standard contractual clauses (SCC) approved by the European Commission, accompanied, where appropriate, by a transfer impact assessment (TIA) and supplementary measures. The safeguards applicable to each provider are those provided in the data processing agreement (DPA) of the respective provider.
| Sub-processor | Purpose | Data categories | Location / transfer mechanism |
|---|---|---|---|
| Microsoft Azure | Cloud hosting and infrastructure | All categories stored in the platform | Processing in the EU/EEA where possible; for any transfers, SCC and supplementary measures |
| Hetzner (Hetzner Online GmbH) | Hosting and infrastructure for certain functions and services | Data processed by the hosted functions and services (depending on use) | EU/EEA (Germany) |
| TomTom | Routing, geocoding and address search | Location coordinates and addresses (which may be associated with persons) | EU/EEA |
| Google Maps Platform | Maps, geocoding and address search | Location coordinates and addresses (which may be associated with persons) | SCC and, where the provider is certified, the Data Privacy Framework |
| Clerk | Authentication and account management | Account and authentication data | Transfer outside the EU/EEA on the basis of SCC and a transfer impact assessment (TIA) |
| MailerSend | Notifications and transactional emails | Contact data, message content | Processing in the EU/EEA; where applicable, SCC |
| Crisp | In-app support (chat) | Contact data, identifiers and any data included by users in support conversations | EU/EEA (France) |
| Dash0 | Logging and observability | Technical data and logs, which may include IP addresses and identifiers | EU/EEA |
| OpenAI | Automatic order entry using artificial intelligence | The content of the orders and documents sent for processing, which may include identification and contact data | Transfer outside the EU/EEA on the basis of SCC and a transfer impact assessment (TIA) |
The transmission of electronic invoices to the ANAF system (SPV) is a legal obligation of the Client as a taxpayer; ANAF does not act as a sub-processor of Routena.
For the invoicing of its own services, Routena acts as a controller. Stripe is not included in this list as a sub-processor for the Client’s Data; its role is described in the Privacy Policy.
GPS location/telematics providers (for example Acron, CargoTrack, Exyond, iTrack) are third-party services contracted directly by the Client, which provide Routena with an API key for accessing the data. They are not sub-processors of Routena, since Routena does not contract them and accesses the data only in accordance with the Client’s instructions.
3. Notification of changes
Routena informs the Client of the intention to add or replace a sub-processor, as a rule at least 15 calendar days in advance, by email or through the platform, before the new sub-processor begins processing. All affected clients are actively notified; subscription to updates (section 5) is offered additionally to other interested persons.
4. Right to object
The Client may raise a reasoned objection regarding a new sub-processor, in writing, within 15 calendar days of the notification. The parties will cooperate in good faith to find a reasonable solution. If a reasonable solution is not identified within a reasonable time, the Client may terminate the part of the Services directly affected by the sub-processor concerned. For the affected part terminated on this ground, Routena refunds proportionally any recurring Fees paid in advance for the period after termination, and the remainder of the Contract remains unaffected, in accordance with the DPA.
5. Subscription to updates
Affected clients are actively notified of changes to the list, in accordance with section 3. In addition, any interested person may receive notifications by sending a request to [email protected]. Previous versions of the list are kept in the legal archive.
6. Infrastructure, jurisdiction and government access
The main ICT infrastructure used for storing the Client’s Data is provided by hosting providers in the EU/EEA (see the table above), being subject mainly to the jurisdiction of the EU member states in which the data centers are located.
Against unlawful international governmental requests for access to data, Routena applies general safeguards such as: encryption of data in transit, the use of standard contractual clauses and transfer impact assessments for transfers outside the EU/EEA, the minimization of transfers and the challenging or notification, to the extent permitted by law, of manifestly unlawful access requests.
7. Contact
For questions regarding the sub-processors: [email protected].