Third-Party Services, Data Processors and Sub-processors
The CXR App platform may work with various external service providers and technologies so that the services can function, be further developed and improve the user experience. CXR App is offered and operated by Visual Memory Works GmbH (“VMW”). VMW is your point of contact for sales, billing, payment processing and support.
These integrations are a natural part of the platform’s technical infrastructure and help to provide the services on a sustainable basis.
TYPES OF THIRD-PARTY PROVIDERS THAT MAY BE USED
External services of the following kinds may be used as part of the platform:
- Cloud and server hosting services
- Data storage and backup systems
- E-mail and notification services
- Payment and financial transaction infrastructures
- Tools for security, monitoring and performance analysis
- Artificial intelligence and automated data processing technologies
- Software services for external integrations
These services may be used for the scalability, security and performance of the platform.
PROVIDERS IN USE
- Hosting of the applications: migration to Hetzner (Germany) planned, existing infrastructure until then
- Hosting of the information website: web server in Turkey
- E-mail hosting (mailbox info@visualmemoryworks.de): Germany
- AI features: OpenAI, Anthropic and Google
- Payments to VMW: Stripe (credit card, PayPal and SEPA Direct Debit, depending on the account and transaction type)
Payments to VMW (subscription, optional setup and other services) are processed through Stripe. The payment methods are credit card, PayPal and SEPA Direct Debit, depending on the account and transaction type. A payment method is offered only where it is available for the relevant account and shown in the checkout process.
To process payments for the CXR subscription and, where applicable, the setup, we process information such as transaction ID, amount, currency, payment and refund status, and invoice data. Full card numbers and comparable payment instrument data are intended to be collected directly by the payment service provider and not stored on VMW’s systems. The data protection role of the payment service provider is not the same for every transaction.
Payments for the CXR software subscription and an optional setup must be kept separate from the payments that your end customers make for your own products, photos or orders. For the latter, you are responsible as the seller and as the contracting party of your end customers. Whether and how payments for your own sales can be accepted through a payment service provider depends on that provider’s acceptance and verification as well as on the respective contract and account model.
DATA DISCLOSURE AND ACCESS
External service providers may only access data to the extent required by the service they provide. This access is limited by contractual obligations and data protection law.
The data protection role of the service providers depends on the processing concerned. Hosting, e-mail and comparable infrastructure providers generally act as processors on behalf of and on the instructions of VMW (Art. 28 GDPR). Providers of AI features may, depending on the service and configuration, be processors or independent controllers for their own purposes. Payment service providers such as Stripe process payment data partly on behalf of their business customers and partly as independent controllers for their own purposes, for example for fraud prevention or to comply with their own legal obligations; the providers describe the details in their privacy notices (for Stripe: Stripe Privacy Center). Transfers to countries outside the EU/EEA only take place if the requirements of Art. 44 et seq. GDPR are met.
If processors use further sub-processors, this only takes place under the conditions of Art. 28(2) and (4) GDPR.
For data that customers (businesses) enter into their apps, those businesses are controllers, and VMW is a technical service provider and processor; service providers used act as sub-processors in that respect.
Some service providers may operate data centers in different countries. Personal data is only transferred to countries outside the European Union or the European Economic Area under the conditions of Art. 44 et seq. GDPR. Further information is provided in the document International Data Transfers.
AI INTEGRATIONS
Some features of the platform may work together with AI-based external services. These services may be used for functions such as text processing, analysis, generating suggestions or automatic content creation.
Services from OpenAI, Anthropic and Google may be used for AI features. The contracting parties, processing locations and transfer bases depend on the service actually used and the contract terms of the respective provider. The fact that the applications are to be operated on servers in Germany does not mean that all AI processing takes place in Germany; it may also take place outside Germany and outside the EU or the EEA. Any such transfer only takes place under the conditions of Art. 44 et seq. GDPR.
Further information is provided in the document Use of Artificial Intelligence and Data Processing Notice.
RESPONSIBILITY OF EXTERNAL PROVIDERS
External service providers operate independently on their own systems and infrastructures. VMW has no direct influence on outages, security vulnerabilities or disruptions that may occur in these providers’ systems. VMW’s responsibility under the GDPR for the careful selection and contractual commitment of its processors remains unaffected.
INTEGRATIONS BY USERS
Users can set up integrations with external systems of their choice via the platform. Users are responsible for the lawfulness of the data passed on as part of these integrations and for their relationships with the third parties concerned.
CHANGES
The external services and integrations used on the platform may be changed, extended or discontinued over time. Current information and procedures may be adapted in line with this notice.
Please direct any questions about this to Visual Memory Works GmbH, Elbestraße 10, 45768 Marl, Germany, e-mail: info@visualmemoryworks.de.