Subprocessors
Last updated: 15 July 2026
This page lists the service providers (processors and subprocessors) that may process personal data in connection with my services. It is maintained for transparency and referenced in the data processing agreement (DPA / AVV, Art. 28 GDPR).
Two scopes are distinguished: providers used for my own website (where I am the controller), and subprocessors used within client projects (where I act as a processor on behalf of a client). For each client project, the binding and authorised list is the signed AVV Annex 4a; this page does not replace that annex.
1. Providers for my own website (dev-portfolio)
For the operation of my portfolio website and business (contact form, customer and referral management, invoicing), I use the following processors:
- MongoDB, Inc. (MongoDB Atlas), USA / EU contracting via MongoDB Limited, Ireland — managed database hosting; cluster operated in an EU region; EU Standard Contractual Clauses (2021/914) per MongoDB DPA.
- Cloudflare, Inc. (USA) — object storage (R2) and delivery (CDN) of uploaded media; EU-U.S. Data Privacy Framework and/or SCCs per Cloudflare DPA (R2 bucket located in the EU).
- Google Ireland Ltd. / Google LLC (USA) — transactional email delivery via Gmail SMTP; EU-U.S. Data Privacy Framework and/or SCCs.
- Vercel Inc. (USA) — hosting and deployment of the website; EU-U.S. Data Privacy Framework and/or SCCs.
2. Subprocessors for client projects (Art. 28 GDPR)
Where I process personal data on behalf of a client (hosting, maintenance, deployment), the following subprocessors may be used. The subprocessors actually used for a specific project are fixed in that project's signed AVV Annex 4a and may differ from this list:
- Hetzner Online GmbH, Germany — server/cloud hosting; processing in the EU (ISO 27001); no transfer instrument required.
- Neon, LLC / Databricks, Inc. (USA) — managed PostgreSQL database; EU region (AWS eu-central-1, Frankfurt); EU-U.S. Data Privacy Framework and SCCs per Databricks/Neon DPA.
- Cloudflare, Inc. (USA) — object storage (R2), optionally CDN/DNS; EU storage location; EU-U.S. Data Privacy Framework, SCCs as fallback per Cloudflare DPA.
- Plus Five Five, Inc. (“Resend”), USA — transactional and newsletter email delivery; EU-U.S. Data Privacy Framework and SCCs per Resend DPA.
3. International transfers
Where a provider processes data outside the EEA, transfers are based on an appropriate safeguard under Chapter V GDPR: an adequacy decision (e.g. EU-U.S. Data Privacy Framework or the Israel adequacy decision) or the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914), supplemented by additional measures where required.
4. Changes to this list
I inform affected clients of any intended change (addition or replacement) of subprocessors at least 4 weeks in advance in text form. Clients may object within 14 days for an important data-protection reason (§ 6 (2) AVV). Publication on this page does not replace that notification in text form.
Data protection contact
- Ali Ramazan Yildirim – ARY Tech Solutions
- Address: Hebelstraße 1, 77880 Sasbach, Germany
- Email: info@arytechsolutions.com
- Phone: +49 151 67145187
Company names, processing locations and DPF certifications can change; the status is reviewed at appropriate intervals, in particular before new engagements. In case of discrepancies between language versions, the German version prevails.