Legal › The agreement
Sub-processors
Every company that handles data on our behalf, and what each one does.
Last updated: 9 October 2026.
This list names every company outside Web and Cloud Innovation Ltd that stores, transmits or otherwise processes personal data as part of running the Service for you, and states exactly what each one can see. It forms part of the Data Processing Agreement.
We will publish a change here and tell you at least thirty (30) days before a new sub-processor starts, so that you can object if you have grounds.
1Who They Are
| Sub-processor | What it processes, and why |
|---|---|
| Hetzner Online GmbH, Germany | The hosting provider. The server, the database and the uploaded files of your installation are held on infrastructure it operates in Germany, unless another location is agreed with you in writing. |
| Google Ireland Limited | Only where you use them: offsite backups held in a private Drive folder you connect with your own account; automated reading of an uploaded document to copy its printed details into a record; and, only if you switch it on, sign-in with a Google account. |
| Microsoft Ireland Operations Limited | Only if you switch it on: sign-in with a Microsoft account. It sees the identity of the person signing in, and nothing else. |
| Your outgoing mail provider | The invoices, reminders, notices and portal invitations the Service sends, with the recipient's address and the content of the message. You configure this yourself, and it is usually your own mail host. |
2Third Parties You Choose To Connect
Some services join your installation only when you connect your own account with them. They are not our sub-processors: you choose them, you hold the contract with them, and what they do with the data they receive is governed by your agreement with them. They are named here so that the list is complete.
Payments — PayMongo and Dragonpay, when you connect your own merchant account with them. They receive what a payment needs: the amount, the reference, and the payer's details as the payer enters them on the provider's own page. Card numbers never touch our servers.
Accounting — Xero, QuickBooks Online, FreshBooks, Sage and Zoho Books, when you connect your own company file with them. What travels is what the package keeps: depending on the package, the client's name and contact details, issued invoices, recorded payments and expenses. Nothing is read back.
3What Is Not A Sub-Processor
Three connections send nothing about the people in your installation to the company named, and are named here only so that the list is complete.
The Airbnb calendar sync fetches a private calendar file that you supply the address for. It is a download. Nothing about a tenant, a guest or a member of staff is sent to Airbnb by the Service.
WhatsApp links open a conversation in the sender's own WhatsApp on their own device. The Service composes a link; it does not transmit a message or a number to Meta.
The concierge on the public website at premises.ph is answered by a model provided by Anthropic PBC, in the United States. It sees what a visitor types into that chat and the public pages it answers from, and never anything held in your installation. For the chat we are the controller, not your processor, so it is described in our Website and customer privacy notice rather than here.
4Where The Data Is
The Service is operated from Malta, and installations are hosted in Germany. Backups are held in the Drive account you nominate, where you connect one.
Where a transfer of personal data protected by the GDPR leaves the European Economic Area, it is covered as clause 10 of the Data Processing Agreement describes. Where personal information protected by RA 10173 leaves the Philippines, the same clause applies.
5The One We Are Often Asked About
An uploaded identification document may be read once by Google's Gemini service, solely to copy the printed details into the tenant's record so that nobody has to type them.
The document is sent for that single reading, is not used to train any model, and the result is written into your own database. If you would rather it never happened, the reader can be switched off in Settings, and the details are typed by hand instead.
6Questions
legal@premises.ph