Sub-processor List

What this list is

A sub-processor is a provider that processes personal data on behalf of CashXChain UG (haftungsbeschränkt) (“CashXChain”) and on our instructions, under a Data Processing Addendum pursuant to Article 28 GDPR. The tables below are the complete list of our sub-processors: what each does, where it processes data, the transfer safeguard, the Article 28 agreement in force between that provider and us, where that provider states how it handles personal data, and the provider’s own sub-processor list. Where a cell is empty, the provider does not publish that document.

A provider that decides the purposes and means itself, or decides them together with us, is a controller rather than a sub-processor and is not in these tables. Those relationships are described in prose after the tables, each with the reason it falls outside Article 28.

A. Product and infrastructure sub-processors

These process personal data as part of delivering the CashXChain platform itself.

B. Internal operations sub-processors

These are not part of the platform. We use them for internal work — drafting, analysis, correspondence and day-to-day administration — where documents and communications may contain personal data of our employees and interns, of partner staff, and of the representatives of our business customers. They do not process customer transaction data, and they sit outside the payment flow.

Our sub-processors’ own sub-processors

Each provider above engages its own sub-processors under Article 28(4) GDPR . Each imposes equivalent data-protection obligations on them and remains liable to us for their performance, as we remain liable to our customers for ours. The right-hand column links to each provider’s current list.

Social-login identity providers

If you choose to sign in with Google, Apple, Microsoft, GitHub or LinkedIn, that provider processes your data during the sign-in process under its own terms. It is not a CashXChain sub-processor: it determines its own purposes and means for that processing and is responsible for it in its own right as an independent controller. We receive only the account information you authorise it to release.

Mobile app distribution

Our mobile apps are distributed through Google Play (Google LLC) and the Apple App Store (Apple Inc.). Where you download or use the apps through those stores, the store operator is not a CashXChain sub-processor: it determines its own purposes and means for the data it collects about downloads, payments and device state, and is responsible for it in its own right as an independent controller.

Licensed Partners: independent controllers and joint controllers

The licensed institutions that perform the regulated payment, conversion, custody and settlement steps are not sub-processors. None of them acts on our instructions, and we cannot instruct any of them out of what its regulator requires. They are named on Regulatory Status & Partner Disclosure. Their role under data protection law is not the same for all of them.

Independent controllers. Most Partners determine the purposes and means of their processing entirely by themselves under their own licence and their own regulatory obligations, and are responsible for it in their own right. We answer for our processing and the Partner answers for its own; neither of us answers for the other’s. Stripe is in this group.

Joint controllers with us. For some processing we and a Partner determine the purposes and means together, which makes us joint controllers for it under Article 26 GDPR . Our agreement with Sokin puts the onboarding, account and instruction data we pass to Sokin in this category. Joint controllership does not mean shared systems or mutual access to each other’s records; it means we are accountable together for that processing. For you it has two practical consequences. You may exercise your data-protection rights against either of us, and Article 82 GDPR  makes each joint controller liable for the whole of the damage caused by processing that infringes the Regulation — so you may claim the full amount from either of us, and we settle the split between ourselves afterwards. An arrangement under Article 26 GDPR  allocates the respective responsibilities between the joint controllers; its essence is published here once it is in place.

Identity verification

Onboarding and identity verification are performed by those same regulated Partners under their own KYC/KYB and anti-money-laundering obligations. The checks are theirs to run and theirs to answer for, not ours to direct, so no Partner is our sub-processor for them; whether a given Partner is an independent controller or a joint controller with us follows the split above. CashXChain engages no separate identity-verification sub-processor.

International transfers

Where a sub-processor processes personal data outside the EEA and the destination is not covered by an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses together with a transfer impact assessment and any supplementary measures the assessment shows are needed.

Changes

We keep this list current in our Legal Center. When we add or replace a sub-processor we update this page and, where the DPA requires it, give business customers advance notice so they may object. Questions: privacy@cashxchain.com.