Subprocessor Schedule

The Buffalo Company

Version: 1.0
Related document: Data Processing Agreement (DPA)
Provider / Processor: Obed Klein, trading as The Buffalo Company
Effective date: 12 November 2026

1. Purpose and scope

1.1. This Schedule identifies the third-party service providers authorised to process personal data on behalf of the Provider in connection with services commissioned by the Customer.

1.2. It forms part of the Provider's Data Processing Agreement.

1.3. A third-party provider is included in this Schedule only where it processes personal data on behalf of the Provider as a subprocessor within the meaning of Article 28 GDPR.

1.4. A provider is not automatically a subprocessor merely because it supplies software, infrastructure, communications, payment or other business services to the Provider.

1.5. The listed subprocessors are relevant only to the services and processing activities for which they are actually used.

2. Authorised subprocessors

2.1. Hetzner Online GmbH

Company: Hetzner Online GmbH
Address: Industriestr. 25, 91710 Gunzenhausen, Germany
Service: Hosting and server infrastructure
Processing purpose:

• Hosting the Provider's monitoring platform.
• Storing and processing technical monitoring information.
• Supporting availability monitoring and related operational services.

Processing location: Germany, subject to the actual hosting product and configured location.

Relevant services: Availability monitoring and other services that use the Provider's hosted monitoring platform.

Notes: Hetzner provides the infrastructure on which the Provider operates its monitoring platform. The Provider maintains the applicable data processing agreement with Hetzner.

2.2. Microsoft Azure

Provider: Microsoft Corporation or the applicable Microsoft contracting entity identified in the Provider's Azure agreement.

Service: Microsoft Azure Blob Storage
Processing purpose:

• Storage of Customer backup data.
• Retrieval of backup data for restoration.
• Supporting the agreed backup and recovery services.

Processing location: The German Azure region identified in the applicable Customer Service Confirmation.

Relevant services: Standalone backup services and Managed Infrastructure engagements that include backup services.

Notes:

• The actual Azure region must be confirmed before the relevant backup service is activated.
• Storage redundancy is configured using Zone-Redundant Storage (ZRS) where available and suitable, or Locally-Redundant Storage (LRS) where ZRS is unavailable or unsuitable.
• Geo-redundant replication is not used unless the Provider has verified that all relevant copies remain in Germany and the arrangement is consistent with the Customer's requirements.
• Microsoft may use additional subprocessors under its own data protection arrangements. The applicable Microsoft Online Services subprocessor information is available through Microsoft's Service Trust Portal.

3. Other providers and their roles

The following providers may be used by the Provider but are not automatically included as subprocessors for Customer personal data processed under this DPA.

3.1. Purelymail / Add Rabbit LLC

Company: Add Rabbit LLC, trading as Purelymail
Address: 502 W 7th St, Suite 100, Erie, PA 16502, USA
Service: Business email hosting.

Purelymail is used for the Provider's business email communications.

In the ordinary course of the Provider's business, Purelymail processes email and account information relating to the Provider's own business communications. This does not automatically mean that Purelymail processes Customer personal data on behalf of the Customer under this DPA.

If the Provider later uses Purelymail or another email service to process Customer personal data specifically on behalf of the Customer, the Provider will assess the processing relationship and update this Schedule where required.

3.2. Stripe

Provider: Stripe, through the applicable Stripe contracting entity
Service: Payment processing and recurring payment collection.

Stripe is used for payment links and recurring card payments.

Stripe may act as an independent controller for certain payment, fraud prevention, compliance and related activities, and as a processor for other activities depending on the particular Stripe service.

The Provider's ordinary use of Stripe for its own invoicing and payment collection does not automatically make Stripe a subprocessor of Customer personal data under this DPA.

If a particular Stripe service is used to process Customer personal data on behalf of the Customer, the Provider will assess the relevant processing role and update this Schedule where necessary.

3.3. Uptime Kuma

Uptime Kuma is monitoring software used by the Provider. It is not a separate subprocessor merely by virtue of being software.

The infrastructure provider hosting the Provider's monitoring platform is identified in Section 2.1.

3.4. Tresorit

Tresorit is used for encrypted backups of the Provider's credential database. This is a Provider security and credential-management arrangement.

It is not currently listed as a subprocessor for Customer personal data processed on behalf of Customers.

If Tresorit is later used to store Customer personal data on behalf of a Customer, the Provider will assess the arrangement and update this Schedule where required.

4. External specialists

4.1. The Provider may engage independent external specialists where reasonably necessary to perform specific technical tasks.

4.2. An external specialist will be treated as a subprocessor under this DPA where the specialist processes Customer personal data on behalf of the Provider.

4.3. Before permitting such processing, the Provider will:

• Identify the specialist and the relevant processing activity.
• Obtain the required authorisation under the DPA.
• Impose appropriate confidentiality and data protection obligations.
• Limit access to the necessary scope and duration.
• Apply appropriate security requirements.
• Ensure that access is revoked when no longer required.

4.4. The Customer will be notified in advance of an intended new subprocessor in accordance with the 30-calendar-day notification and objection procedure in the DPA.

4.5. Where emergency access is necessary and advance notification is not reasonably practicable, the Provider will notify the Customer afterward as soon as reasonably practicable.

4.6. A specialist who does not process Customer personal data on behalf of the Provider is not automatically a subprocessor under this Schedule.

5. Changes to subprocessors

5.1. The Provider may add or replace subprocessors in accordance with Section 10 of the DPA.

5.2. The Provider will give the Customer at least 30 calendar days' advance notice of an intended addition or replacement of a subprocessor.

5.3. The Customer may raise a reasoned data protection objection within that period.

5.4. The Provider will consider the objection and assess reasonable alternatives or additional safeguards.

5.5. If no workable solution can be agreed, either Party may terminate the affected processing service in accordance with the DPA and the Managed Services Agreement.

5.6. The Provider will maintain an up-to-date version of this Schedule and make it available to the Customer.

6. International transfers

6.1. The processing locations identified in this Schedule describe the intended locations for the relevant services.

6.2. The Provider will assess relevant international transfers and ensure that transfers of Customer personal data are made in accordance with Chapter V GDPR where applicable.

6.3. The use of a German hosting or storage region does not, by itself, establish that every ancillary support, security, metadata or subprocessor operation takes place exclusively in Germany.

6.4. Where a subprocessor or its downstream providers may access or process Customer personal data outside the European Economic Area, the Provider will assess the applicable transfer mechanism and safeguards.

6.5. Relevant international transfer arrangements will be made available to the Customer upon reasonable request, subject to confidentiality and security restrictions.

7. Schedule administration

Schedule owner:
Obed Klein
Trading as The Buffalo Company
Steingruberstr. 5
90579 Langenzenn
Germany
hello@thebuffalocompany.com

Current version: 1.0
Last updated: 12 November 2026

This Schedule forms part of the Data Processing Agreement and is subject to its terms.

End of Subprocessor Schedule