Sub-processors

Trusq GmbH processes personal data on behalf of its customers (Article 28 GDPR). For clearly defined sub-tasks it engages the sub-processors listed in sections 1 to 3. Those sections are Annex 2 of the Data Processing Agreement and apply to all customers. Which entries apply to a given customer depends on the booked edition and the channels in use. Sections 4 to 8 are provided for transparency and are not part of the annex.

All sub-processors are bound by a contract under Article 28 GDPR. Data is processed outside the European Union only where this is stated explicitly below.

1. For every customer

Hetzner Online GmbH

• Address: Industriestraße 25, 91710 Gunzenhausen, Germany
• Task: operation of the application, the database, the search index and the message queues (Falkenstein data centre), and object storage for file attachments, data exports, invoices and database backups (Nuremberg data centre)
• Data: all data processed in Trusq
• Place of processing: Germany
• Basis: data processing agreement under Article 28 GDPR

2. Standard edition only

Mistral AI SAS

• Address: 15 Rue des Halles, 75001 Paris, France
• Task: language models on the "La Plateforme" service, hosted in the EU: Mistral Large (mistral-large-latest) for classifying enquiries, replies, suggested replies and summaries; Mistral Embed (mistral-embed) for matching enquiries against the customer's knowledge base
• Data: subject and the conversation history of the case being handled, in shortened form, the matching excerpts or full articles from the customer's knowledge base, and the knowledge-base texts used for matching; no account information about the customer
• Storage at Mistral: inputs and outputs are stored by Mistral for at most thirty (30) days for abuse monitoring and are not used to train models
• Place of processing: European Union (France)
• Basis: data processing agreement under Article 28 GDPR
• Note: the Kanzlei edition uses no external AI provider (clauses 2.3 c and 5.3 of the Terms).

3. Only when the respective channel is used

These sub-processors receive data only once the customer sets up the named channel in its workspace.

WhatsApp Ireland Limited (WhatsApp channel)

• Address: Merrion Road, Dublin 4, D04 X2K5, Ireland; parent company Meta Platforms, Inc., Menlo Park, USA
• Task: delivery of incoming and outgoing messages through the WhatsApp Business Platform
• Data: the end customer's phone number, message content and media, delivery metadata and timestamps
• Place of processing: European Union (Ireland); processing by WhatsApp LLC and Meta Platforms, Inc. in the USA may occur. WhatsApp data of phone numbers provided by Trusq is stored at rest in the EU (Frankfurt).
• Basis: the "WhatsApp Business Data Processing Terms" as the data processing agreement under Article 28 GDPR with WhatsApp Ireland Limited; the transfer to the USA rests on the "WhatsApp Business Data Transfer Addendum" with the European Commission's standard contractual clauses and on WhatsApp LLC's certification under the EU-US Data Privacy Framework; Trusq has assessed the transfer in a transfer impact assessment
• Note: WhatsApp is not offered in the Kanzlei edition (clause 2.2 b of the Terms).

Meta Platforms Ireland Limited (Instagram channel)

• Address: Merrion Road, Dublin 4, D04 X2K5, Ireland; parent company Meta Platforms, Inc., Menlo Park, USA
• Task: delivery of incoming and outgoing messages through the Instagram Messaging API
• Data: the end customer's Instagram identifier, message content and media, delivery metadata and timestamps
• Place of processing: European Union (Ireland); processing by Meta Platforms, Inc. in the USA may occur. Instagram has no EU storage option.
• Basis: data processing agreement under Article 28 GDPR with Meta Platforms Ireland Limited; the transfer to Meta Platforms, Inc. rests on the European Commission's standard contractual clauses concluded by Meta and Meta Platforms, Inc.'s certification under the EU-US Data Privacy Framework; Trusq has assessed the transfer in a transfer impact assessment
• Note: Instagram is not offered in the Kanzlei edition (clause 2.2 b of the Terms).

Channels without a sub-processor

• Email: Trusq runs its own mail servers on Hetzner's infrastructure in Germany. No further provider is involved in sending or receiving email.
• Matrix: Trusq connects to the Matrix homeserver the customer operates or obtains itself. That server is not engaged by Trusq.
• Web form: runs entirely on Hetzner's infrastructure.

4. Provider for billing the Trusq contract (not a sub-processor under the DPA)

For the fees the customer pays to Trusq, Trusq itself is the controller (clause 3.3 of the DPA). The processing is described in the privacy policy.

Mollie B.V.

• Address: Keizersgracht 126, 1015 CW Amsterdam, Netherlands
• Task: payment processing for the customer's fees to Trusq (credit card; further payment methods where offered)
• Data: name and email address of the billing contact and the payment details Mollie itself collects for the chosen payment method
• No end-customer data: Mollie receives no ticket content and no data about the customer's own customers.
• Place of processing: European Union (Netherlands)

5. Operated by Trusq itself

The following components run on the infrastructure provided by Hetzner in Germany under Trusq's control. Their makers receive no data and are not sub-processors:

• mail servers for incoming and outgoing email (Postfix)
• search index (Meilisearch)
• billing system (Lago)

The AI functions of the Kanzlei edition will, once offered, be provided exclusively on hardware Trusq operates itself within the EU (clause 2.3 c of the Terms); Trusq rents the GPU servers for this from a data centre operator in the EU (section 7). No external AI provider is used there.

6. Services engaged by the customer

Where the customer activates a connection to a third-party service in its workspace, such as a webhook to an automation service or a link to its own business software, Trusq transmits data to that service on the customer's behalf. The customer chooses the service and concludes the necessary contracts itself. Such services are not sub-processors of Trusq.

7. Planned

• sipgate GmbH, Düsseldorf, Germany: telephony for a planned voice channel. Will be engaged only after a contract under Article 28 GDPR has been concluded and customers have been notified.
• Seeweb srl, Frosinone, Italy: GPU hosting for the AI functions of the Kanzlei edition. Will be engaged only after a contract under Article 28 GDPR has been concluded and customers have been notified.

8. No longer used

• Sinch AB, Sweden (Mailjet and Conversation API): used for sending email until 2026-06-29 and, before that, for the WhatsApp connection. Trusq has transmitted no data to Sinch since.

9. Changes to this list

Trusq announces the addition or replacement of a sub-processor at least thirty (30) days before it is used, in text form, by email to the administrative contacts of the customer account. The customer may object for an important reason within fourteen (14) days of receiving the announcement; as long as a timely objection has not been resolved, Trusq does not use the new sub-processor for the customer's data (clause 6.2 of the Data Processing Agreement). This page is updated with every change; the date at the top states the version.

Change history

• 2026-10-25: contracting party for the WhatsApp channel corrected: WhatsApp Ireland Limited, previously listed under Meta Platforms Ireland Limited; the service and the contract are unchanged and no sub-processor is added. Meta Platforms Ireland Limited is now listed for Instagram only. Error logging removed from section 5 because it is not used; Seeweb srl added under "Planned".
• 2026-10-21: first published version.

Questions about data protection are answered at privacy@trusq.de.