Sub-processors

1. Introduction

1.1. This list contains the sub-processors engaged by Genz IT Solutions GmbH ("Provider") for the provision of the hosted HotCodePush service. It forms part of the Data Processing Agreement (DPA) as Annex 3.

1.2. The listed sub-processors process customer data on behalf of the Provider, including the update-delivery data that end-user devices send, the customer's application bundles and the metadata of releases and bundles.

1.3. Not covered by this list:

• Merchant of Record (Polar Software Inc.): Polar acts as an independent controller in the purchase process, not as a sub-processor of the Provider. Its privacy policy is available on its website.
• Webhook endpoints configured by the customer: Where the customer sends notifications to a chat or collaboration service or to its own URL, the operator of that endpoint is a recipient engaged by the customer (DPA Section 7.5), not a sub-processor of the Provider.
• Recipients engaged by the Provider as controller: Service providers that the Provider engages solely for its own purposes (e.g. email delivery, support, error monitoring, analytics, the status page) are listed in the Privacy Policy at https://hotcodepush.com/legal/privacy-policy.

2. Change Notification

2.1. The Provider shall notify customers at least 30 days before the intended engagement of a new or changed sub-processor in text form. Customers may track changes via email notification or by subscribing to this page.

2.2. In the event of a justified objection on data protection grounds, the provisions of Section 7 of the DPA shall apply.

3. Current Sub-processors

Name	Purpose / categories of data processed	Processing location	Transfer mechanism
Cloudflare, Inc.	Edge network, CDN, serverless request processing and message queues; object storage for bundles and files in the EU jurisdiction. Processes update-delivery data and bundles.	Storage in the EU. Requests are processed at the edge location nearest the device. Sub-processor established in the USA	EU-US Data Privacy Framework (DPF-certified), EU Standard Contractual Clauses (SCCs) as fallback
Hetzner Online GmbH	Cloud infrastructure (compute, storage) and encrypted offsite backups (including customer data).	Germany, EU	Adequacy (EU)
PlanetScale, Inc.	Database services. Stores device identifiers, device reports and the metadata of releases and bundles.	Frankfurt, Germany (AWS eu-central-1). Sub-processor established in the USA	EU-US Data Privacy Framework (DPF-certified), EU Standard Contractual Clauses (SCCs) as fallback
Scaleway SAS	Cloud infrastructure (compute, storage) and encrypted offsite backups (including customer data); computation of delta updates between bundle versions.	France, EU	Adequacy (EU)

4. Change History

Date	Change
2026-10-25	Initial draft