Sub-processors of the Nimbu platform
Last updated: 27 July 2026 • Nimbu, a platform by Zenjoy BV • Version 1.2
This document is a courtesy translation. Only the Dutch version is legally binding; in case of any discrepancy, the Dutch text prevails.
Zenjoy BV engages the sub-processors listed below for the processing of customer data on instruction. Zenjoy imposes appropriate data protection and security obligations on them in writing and remains responsible in accordance with the Nimbu Data Processing Agreement.
A proposed addition or replacement is communicated at least fifteen (15) days in advance by e-mail or via the Nimbu admin environment. The Customer may object within that period on reasonable data protection grounds in accordance with article 6 of the DPA.
In the event of an urgent replacement due to a security risk, a legal obligation, insolvency, a serious breach or an unexpected termination by an existing sub-processor, Zenjoy may, in accordance with article 6 of the DPA, immediately engage a suitable replacement; it informs the Customers thereof without undue delay.
| Sub-processor | Processing activity and data | Main location | Possible transfer outside the EEA and safeguard |
|---|---|---|---|
| OVHcloud / OVH SAS | Production hosting, compute, Kubernetes infrastructure, network, primary storage and databases, primary backups and OVH Logs Data Platform; customer content, account and technical data and logs | France / EEA | No planned transfer for core storage; statutory exceptions in accordance with the DPA |
| Hetzner Online GmbH | Encrypted offsite backups of customer data | Germany / EEA | No |
| Scaleway SAS | Transactional e-mail; recipient, delivery address, message content and technical delivery data | France / EEA | No for the agreed processing |
| BunnyWay d.o.o. / Bunny.net | DNS and CDN services; publicly retrievable website content, request data and IP addresses | EU undertaking; edge locations worldwide | Yes, depending on the edge location; adequacy decision where applicable and otherwise the relevant standard contractual clauses with supplementary measures |
| Mistral AI SAS | AI-based spam detection on form submissions; message content and technical metadata. Processing with zero data retention; data is not stored and not used for model training | France / EEA | No; processing and hosting within the EEA |
The in-house spam and abuse filters for form and spam protection and GlitchTip for error tracking run self-hosted within the Nimbu Kubernetes environment on the OVH infrastructure. The software suppliers therefore have no access to production data and are not sub-processors for this processing.
Optional integrations that a Customer configures directly with its own account or its own credentials are not automatically sub-processors of Zenjoy. The qualification always follows from the actual processing. Where Zenjoy itself engages a third party to process customer data on instruction, that third party is included as a sub-processor on this list.
For push notifications, each Customer configures the connection with its own Firebase, APNs or Windows credentials and under its own account or its own project with the supplier concerned. Google, Apple and Microsoft are engaged directly by the Customer for that customer configuration and are not sub-processors of Zenjoy in that respect. If Zenjoy itself later engages one of these suppliers to process customer data on instruction, the supplier will be included on this list in advance via the DPA procedure.
Questions or a reasoned objection may be addressed to help@zenjoy.be.
The processing locations, retention commitments and transfer safeguards listed above are periodically verified against the data processing agreements actually concluded and the service configurations of the suppliers concerned. Zenjoy keeps the version, date and change history of every published version of this list.