Where Webright processes personal data for a client, the client is the controller and Webright is the processor (article 24.1 of the general terms and conditions). The suppliers that Webright engages for this purpose and that are able to see that data are sub-processors. Webright imposes obligations on them that are no less strict than those of Webright itself, and data only leaves the European Economic Area under a valid transfer mechanism (article 25.1).
For each client, only the part of this list that relates to the services purchased applies. Which services those are is stated in the quote or the service description.
| Party | Service | Data | Location and transfer |
|---|---|---|---|
| Hetzner Online GmbHGunzenhausen, Germany | Hosting of websites, databases and the management server; daily backups in Hetzner Object Storage | Everything the website or application stores: form submissions, accounts, orders, server logs with IP address | Germany (Falkenstein and Nuremberg). No transfer outside the EU. |
| Ploi B.V.The Netherlands | Server management, updates and backup scheduling for the WordPress hosting | Administrative access to the server, and with it to the files and the database of the website | The Netherlands. No transfer outside the EU. |
| Brevo SASParis, France | Sending of form and system email; contact management | Name, email address, phone number and message content of form submissions | EU (France). No transfer outside the EU. |
| Cloudflare, Inc.United States | DNS, CDN, security and proxy for sites that run through Cloudflare | IP address and request data of visitors | Global network. EU-US Data Privacy Framework. |
| Google Ireland LimitedDublin, Ireland | Google Analytics 4 and Tag Manager; where agreed, Google Ads conversion measurement | Pseudonymous identifiers, cookie IDs, behavioural and conversion data | EU and United States. EU-US Data Privacy Framework (Google LLC). |
| Microsoft Ireland Operations LimitedDublin, Ireland | Microsoft Clarity: session recordings and heatmaps, where agreed | Masked session recordings, device and page data, country or region; the IP address is not stored | EU and United States. EU-US Data Privacy Framework (Microsoft). |
| Vercel Inc.United States | Hosting of static custom sites and serverless functions, such as a contact form | Server logs with IP address; form submissions that pass through a server function | Frankfurt region (EU). EU Standard Contractual Clauses. |
| Neon, Inc.United States | Database hosting for custom applications | The data that the application stores, such as leads and customer data | Frankfurt region (EU, AWS). EU Standard Contractual Clauses. |
| UAB MailerLiteVilnius, Lithuania | Newsletter sign-ups and sending, where agreed | Email address, time of sign-up, anonymised IP address | EU (Lithuania). No transfer outside the EU. |
| CookieYes LimitedUnited Kingdom | Cookie banner and recording of the consent choice | Consent choice with timestamp and an anonymised identifier of the visitor | United Kingdom. EU adequacy decision for the UK. |
Status as at 8 September 2026. Locations and transfer mechanisms have been taken from the data processing terms of the supplier concerned.
Not on this list
- Platforms and services with which you enter into an agreement yourself, such as Shopify, payment service providers, your own email provider or domain registrar. These are your own processor or supplier, even if Webright works in them on your behalf (articles 15.2 and 22.3 of the general terms and conditions).
- Services that Webright uses solely for its own business operations, such as uptime monitoring that checks only a public URL, or the forms and the site scan on webright.nl itself. For these, Webright itself is the controller; see the privacy policy.
Changes and objections
If Webright wishes to add or replace a sub-processor, it will inform clients in advance and update this page. You may lodge a reasoned objection within 14 days of that announcement via [email protected]. If we cannot resolve the matter together, you may terminate the service concerned. This is set out in article 25.1 of the general terms and conditions.
Version history
- Version 1, 8 September 2026: first publication, accompanying version 1.1 of the general terms and conditions.