Zurück zur Startseite
Rechtsdokument
Verzeichnis der Unterauftragsverarbeiter
Die Dritten, die handlo.ai mit der Verarbeitung personenbezogener Daten beauftragt, gepflegt gemäß den Artikeln 28 und 30 DSGVO.
Zuletzt aktualisiert: 14. Juni 2026|Gültig ab: 14. Juni 2026
Diese Rechtsdokumente werden verbindlich in englischer Sprache veröffentlicht. Übersetzte Versionen folgen in Kürze — bis dahin ist der englische Text unten maßgeblich.
Die folgende Tabelle listet die Unterauftragsverarbeiter auf, die handlo.ai mit der Verarbeitung personenbezogener Daten im Auftrag seiner Kunden beauftragt, einschließlich Zweck, Datenkategorien, Hosting-Standort und rechtmäßigem Übermittlungsmechanismus.
| Unterauftragsverarbeiter | Zweck | Datenkategorien | Hosting-Standort | Übermittlungsmechanismus |
|---|---|---|---|---|
| Supabase, Inc. | Primary database and file storage | Contact identifiers, Call data, AI-generated data, Account data | European Union (Frankfurt / AWS eu-central-1) | EU hosting — no transfer outside the EEA |
| Vapi.ai | AI voice call processing and the managed speech pipeline | Caller phone number, Call recording, Transcript | United States | Standard Contractual Clauses (Module 3) |
| OpenAI, L.L.C. | Embeddings, summarization, and AI content generation | Transcript, Knowledge-base content, AI-generated data | United States | Standard Contractual Clauses (Module 3) |
| Twilio Inc. | Phone infrastructure, WhatsApp message transport (BSP), and phone-number reputation (Lookup) | Caller phone number, Notification content | United States | Standard Contractual Clauses (Module 3) |
| Telnyx LLC | Phone infrastructure | Caller phone number | United States | Standard Contractual Clauses (Module 3) |
| Deepgram, Inc. | Speech-to-text transcription (engaged via Vapi) | Call audio, Transcript | United States | Standard Contractual Clauses (Module 3); engaged via Vapi |
| ElevenLabs, Inc. | Text-to-speech voice synthesis (engaged via Vapi) | Assistant speech content | United States | Standard Contractual Clauses (Module 3); engaged via Vapi |
| Cartesia AI | Text-to-speech voice synthesis (engaged via Vapi) | Assistant speech content | United States | Standard Contractual Clauses (Module 3); engaged via Vapi |
| Microsoft Azure | Text-to-speech / speech-to-text for select languages (engaged via Vapi) | Assistant speech content, Call audio | United States / European Union (region managed by Vapi) | Standard Contractual Clauses (Module 3); engaged via Vapi |
| Meta Platforms, Inc. | WhatsApp platform / notification delivery | Caller phone number, Notification content | United States | Standard Contractual Clauses (Module 3) |
| Telegram Messenger Inc. | Telegram notification delivery to the Customer's own Telegram chat (only when the Customer enables it) | Notification content | Outside the EEA | At the Customer's instruction — the Customer selects Telegram as its own notification channel |
| Stripe, Inc. | Payment processing (Stripe acts as an independent controller for payment data) | Billing contact, Payment metadata | United States | Standard Contractual Clauses (Module 3); Stripe's own controller-level safeguards apply |
| Resend, Inc. | Transactional email delivery | Recipient email, Notification content | United States | Standard Contractual Clauses (Module 3) |
| Functional Software, Inc. (Sentry) | Error monitoring and diagnostics (processes only Handlo diagnostic data) | IP address, Diagnostic metadata | United States | Standard Contractual Clauses (Module 3) |
| Upstash, Inc. | Rate limiting and short-lived caching | Caller phone number, Cached assistant configuration, Transient call-session data, Aggregated analytics | European Union | EU hosting — no transfer outside the EEA |
| Google LLC | Calendar integration and Google Drive document ingestion (when enabled) | Calendar event data, Document content, Account data | United States | Standard Contractual Clauses (Module 3) |
| Microsoft Corporation | OneDrive & SharePoint document ingestion (when enabled) | Document content, Account data | United States / European Union | Standard Contractual Clauses (Module 3) |
| HighLevel, Inc. (GoHighLevel) | CRM sync to the Customer's connected GoHighLevel account (when enabled) | Contact identifiers, Lead / opportunity data, Call summary | United States | Standard Contractual Clauses (Module 3) |
| HubSpot, Inc. | CRM sync to the Customer's connected HubSpot account (when enabled) | Contact identifiers, Lead / deal data, Call summary | United States | Standard Contractual Clauses (Module 3) |
| IPQualityScore, Inc. (IPQS) | Caller phone-number reputation / spam scoring (Growth and Business tiers) | Caller phone number | United States | Standard Contractual Clauses (Module 3) |
| PostHog, Inc. | Product analytics (consent-gated; ingest reverse-proxied via /ingest) | Usage / event data, IP address, Pseudonymous user identifier | European Union | EU hosting — no transfer outside the EEA |
| Railway Corp. | Background worker / job-processing compute (exports, recordings, transcripts) | Contact identifiers, Call data, AI-generated data, Account data | European Union (europe-west4) | EU hosting — no transfer outside the EEA |
| Crisp IM SAS | Support live-chat widget | Contact identifiers, Support message content, IP address | European Union (France) | EU hosting — no transfer outside the EEA |
Wir benachrichtigen Kunden mindestens 30 Tage vor der Aufnahme eines neuen Unterauftragsverarbeiters, wie in unserer Auftragsverarbeitungs-Zusatzvereinbarung festgelegt.