Sub-processor Registry
Last updated: 2026-02-12
Version: 1.6
Applies to: Cloudbear B.V. services
Purpose and scope
Cloudbear processes personal data on behalf of its customers as a processor within the meaning of Art. 4(8) GDPR. To deliver its services, Cloudbear engages sub-processors as permitted under Art. 28(2) and (4) GDPR and under the Data Processing Agreement concluded with each customer.
This page lists all sub-processors currently authorised. It is maintained as the authoritative register referenced in the Cloudbear Data Processing Agreement.
Cloudbear remains fully liable to the customer for the performance of each sub-processor's obligations.
Contractual safeguards
Each sub-processor listed below is bound by a written agreement imposing data protection obligations no less protective than those in the Cloudbear DPA, in accordance with Art. 28(4) GDPR. Sub-processors are assessed prior to engagement and reviewed periodically as part of Cloudbear's supplier management process under ISO/IEC 27001:2022.
Where a sub-processor processes personal data outside the European Economic Area, the transfer is covered by the mechanism stated in the table below.
Applicability
Not all sub-processors apply to every customer. The "Applicable services" column indicates which Cloudbear services each sub-processor supports. Sub-processors marked "All services" support Cloudbear's general business operations and apply to every customer relationship.
Change notification and objection
Cloudbear notifies customers of any intended addition or replacement of a sub-processor. Notification is given to customers receiving the services for which the sub-processor is engaged. Customers may object on reasonable data protection grounds, in accordance with the procedure set out in the DPA.
Where a sub-processor must be replaced immediately for reasons of security, service continuity or legal compliance, Cloudbear may do so without prior notice and will notify affected customers as soon as reasonably possible.
Current sub-processors
Infrastructure and facilities
| Legal entity | Applicable services | Registered address | Service and purpose | Data categories | Data subjects | Processing location | Transfer mechanism |
|---|---|---|---|---|---|---|---|
| CBWS B.V. | Managed Hosting | Spaarpot Oost 6B, 5667 KT Geldrop, Netherlands | Virtual server and network infrastructure hosting customer workloads | Any personal data contained in customer workloads; connection and traffic metadata | Customer end users and personnel | NL | N/A (EEA) |
| Scaleway S.A.S. | Managed Hosting, Object Storage | 8 rue de la Ville l'Eveque, 75008 Paris, France | Virtual server, network and Object Storage infrastructure hosting customer data | Any personal data contained in customer workloads; connection and traffic metadata | Customer end users and personnel | NL | N/A (EEA) |
| OVH S.A.S. | Managed Hosting, Object Storage | 2 rue Kellermann, 59100 Roubaix, France | Virtual server and network infrastructure hosting customer workloads | Any personal data contained in customer workloads; connection and traffic metadata | Customer end users and personnel | FR / NL | N/A (EEA) |
| BUNNYWAY, informacijske storitve d.o.o. | CDN, WAF | Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia | Content delivery network, edge caching and WAF services for customer-facing services | IP addresses, request logs, user agent and connection metadata | Customer end users | Global edge network, EU storage | EU SCCs (2021/914) for non-EEA edge locations |
Software and platform services
| Legal entity | Applicable services | Registered address | Service and purpose | Data categories | Data subjects | Processing location | Transfer mechanism |
|---|---|---|---|---|---|---|---|
| Nextname B.V. | Domains | Markerkant 13 18, 1314 AN Almere, Netherlands | Domain name registration and management on behalf of customers | Registrant name, address, email address, telephone number | Customer contacts and personnel | NL | N/A (EEA) |
| Tideways GmbH | PHP Tracing | Königswinterer Straße 116, 53227 Bonn, Germany | Application performance monitoring and tracing for hosted PHP applications | Request URLs and parameters, trace and error data, and any personal data incidentally contained therein | Customer end users and personnel | DE | N/A (EEA) |
Support and communication
| Legal entity | Applicable services | Registered address | Service and purpose | Data categories | Data subjects | Processing location | Transfer mechanism |
|---|---|---|---|---|---|---|---|
| Google Ireland Limited | All services | Gordon House, Barrow Street, Dublin 4, Ireland | Google Workspace: email, document storage and collaboration | Name, business email address, correspondence content | Customer contacts and personnel | EU, with support access from third countries | Cloud Data Processing Addendum: EU-US Data Privacy Framework or EU SCCs (2021/914) |
| Slack Technologies Limited | All services | Salesforce Tower, 60 R801, North Dock, Dublin, Ireland | Customer support communication via shared channels and internal incident coordination | Name, business email address, message and file content, and personal data contained in support and incident discussions including account identifiers, IP addresses and log extracts | Customer contacts and personnel; customer end users | EU | Data Processing Addendum: EU SCCs (2021/914); EU-US Data Privacy Framework via Salesforce |
Facility locations
The following facilities are used to host customer data. Facility operators are engaged by the relevant sub-processor, not directly by Cloudbear.
| Sub-processor | Facility operator | Site | City | Country |
|---|---|---|---|---|
| CBWS B.V. | NorthC Datacenters | Eindhoven 1 | Eindhoven | NL |
| CBWS B.V. | NorthC Datacenters | Eindhoven 2 | Eindhoven | NL |
| Scaleway S.A.S. | Scaleway | AMS1 | Amsterdam | NL |
| Scaleway S.A.S. | Scaleway | AMS2 | Amsterdam | NL |
| Scaleway S.A.S. | Scaleway | AMS3 | Amsterdam | NL |
| OVH S.A.S. | OVHcloud | Paris Region, zone eu-west-par-a | Paris region | FR |
| OVH S.A.S. | OVHcloud | Paris Region, zone eu-west-par-b | Paris region | FR |
| OVH S.A.S. | OVHcloud | Paris Region, zone eu-west-par-c | Paris region | FR |
| OVH S.A.S. | OVHcloud | Amsterdam Local Zone | Amsterdam | NL |
| BUNNYWAY d.o.o. | Various, see note below | Global edge network | Multiple | Multiple |
Scaleway and OVHcloud do not publish street-level addresses or, for Local Zones, the underlying facility operator. Where a facility operator is not disclosed, the sub-processor remains contractually responsible for the processing.
BUNNYWAY d.o.o. operates a global content delivery network whose points of presence change as the network expands. The current list of locations is published by the provider at https://bunny.net/network/. Content cached at edge locations outside the European Economic Area is covered by the transfer mechanism stated in the sub-processor table above.
Change log
Entries dated before the initial publication of this register are recorded retrospectively and reflect the date on which each sub-processor was engaged.
| Date | Version | Change | Effective date |
|---|---|---|---|
| 2019-02-04 | 1.0 | Initial sub-processors on commencement of operations: Google Ireland Limited | 2019-02-04 |
| 2019-12-20 | 1.1 | Slack Technologies Limited added as sub-processor for customer support communication | 2019-12-20 |
| 2020-11-01 | 1.2 | Scaleway S.A.S. added as sub-processor for infrastructure hosting | 2020-11-01 |
| 2023-03-27 | 1.3 | BUNNYWAY d.o.o. added as sub-processor for content delivery | 2023-03-27 |
| 2024-11-05 | 1.5 | CBWS B.V. added as sub-processor for infrastructure hosting | 2024-11-05 |
| 2025-12-10 | 1.6 | OVH S.A.S. added as sub-processor for infrastructure hosting | 2025-12-10 |
Contact
Questions regarding this register or Cloudbear's processing activities: compliance@cloudbear.nl