This is a translation for your information. Only the German version is legally binding. To the German version

Legal · Art. 28 GDPR

Sub-processors

As of: 10 September 2026 · Version 4

Versioned register of sub-processors pursuant to § 6 of the data processing agreement. Changes (addition/replacement) are communicated to customers in text form at least 30 days in advance (DPA § 6). Where third countries are involved, transfer impact assessments are available (on request).

  1. 1netcup GmbH

    Daimlerstraße 25, 76185 Karlsruhe, Deutschland

    Shift
    Hosting/server operation, database, backups
    Data
    all order data
    City
    Data centers in Germany
    Transfer
    no third-country transfer
    Contract
    netcup DPA (Art. 28 GDPR)

  2. 2Cloudflare, Inc.

    101 Townsend St, San Francisco, CA 94107, USA

    Shift
    Object storage (backups/media), CDN
    Data
    Backup copies of the processing data, media files including proof-of-delivery recordings
    City
    Storage in EU region; remote access from a third country possible
    Transfer
    EU Standard Contractual Clauses + EU-US Data Privacy Framework
    Contract
    Cloudflare DPA

  3. 3Plus Five Five, Inc. (Resend)

    2261 Market Street #5039, San Francisco, CA 94114, USA

    Shift
    Transactional email sending
    Data
    Email addresses, names, order/reservation contents of the emails, delivery, open and click events
    City
    EU region; third-country access possible
    Transfer
    EU Standard Contractual Clauses
    Contract
    Resend DPA

  4. 4Twilio Ireland Limited

    3 Dublin Landings, North Wall Quay, Dublin 1, Irland

    Shift
    SMS sending
    Data
    Phone numbers, message contents
    City
    EU routing; third-country access possible
    Transfer
    EU Standard Contractual Clauses + EU-US Data Privacy Framework
    Contract
    Twilio DPA

  5. 5Functional Software, Inc. (Sentry)

    45 Fremont Street, San Francisco, CA 94105, USA

    Shift
    Error diagnostics/monitoring
    Data
    technical error, device and crash data, technical usage traces, pseudonymised usage data
    City
    EU region
    Transfer
    EU Standard Contractual Clauses + EU-US Data Privacy Framework
    Contract
    Sentry DPA

  6. 6fiskaly GmbH

    Tegetthoffstraße 7, 1010 Wien, Österreich

    Shift
    Certified cloud TSE + fiscalisation (POS module only)
    Data
    Transaction data of the TSE signing
    City
    EU
    Transfer
    no third-country transfer
    Contract
    fiskaly DPA

  7. 7Expo, Inc.

    650 Castro St, Mountain View, CA 94041, USA

    Shift
    Push notifications and app updates
    Data
    Push token, device/app identifiers, content of the push notification (order number, amount, name of the person ordering)
    City
    USA
    Transfer
    EU Standard Contractual Clauses
    Contract
    Expo DPA

  8. 8Google Ireland Limited / Google LLC

    Gordon House, Barrow Street, Dublin 4, Irland

    Shift
    Address autocomplete, sign-in with Google, Business Profile, Android push (FCM)
    Data
    Address input, email, name, review data, push token and push content
    City
    EU/USA
    Transfer
    EU Standard Contractual Clauses + EU-US Data Privacy Framework
    Contract
    Google Cloud/Ads DPA

  9. 9Apple Inc.

    One Apple Park Way, Cupertino, CA 95014, USA

    Shift
    Push delivery (APNs), Sign in with Apple
    Data
    Push token and content, Apple ID, email
    City
    USA
    Transfer
    EU Standard Contractual Clauses + EU-US Data Privacy Framework
    Contract
    Apple Developer Agreement / DPA

  10. 10OpenStreetMap Foundation

    St John's Innovation Centre, Cowley Road, Cambridge CB4 0WS, Vereinigtes Königreich

    Shift
    Geocoding of delivery addresses (zone check), map tiles on the directions page
    Data
    Street, house number, city of the delivery address; IP address of site visitors
    City
    United Kingdom
    Transfer
    Adequacy decision of the EU Commission
    Contract
    independent recipient, not a sub-processor (public service without an Art. 28 contract; legal basis Art. 6(1)(f) GDPR); use limited to what is necessary

  11. 11Anthropic PBC

    548 Market St, San Francisco, CA 94104, USA

    Shift
    Draft replies to customer reviews (only if the feature is enabled)
    Data
    Reviewer's name, review text, stars
    City
    USA
    Transfer
    EU Standard Contractual Clauses; no use for training purposes
    Contract
    Anthropic DPA

  12. 12Serper Technologies (serper.dev)

    USA

    Shift
    Search engine rankings (only with the SEO add-on booked)
    Data
    Business and location names
    City
    USA
    Transfer
    EU Standard Contractual Clauses
    Contract
    Serper Terms/DPA

  13. 13ready2order GmbH

    Wien, Österreich

    Shift
    Handover of kiosk orders to a third-party POS system (only if configured accordingly)
    Data
    Order items, table, amounts
    City
    EU
    Transfer
    no third-country transfer
    Contract
    ready2order DPA

Stripe, PayPal and the card terminal provider chosen by the customer (e.g. SumUp, Telecash) are independent controllers (not sub-processors). If a customer objects to a change for data protection reasons and this cannot be addressed by a remedy, a reasonable alternative or deactivation of the affected function, a special right of termination exists for the affected service (DPA § 6). Earlier versions of this register are archived and available on request: info@menuheld.de.