Version 1
Sub-processors
In force since 12 October 2026 · Published on 12 October 2026
Translation of the Spanish text, which is the binding one.
On this page
What this list covers
This list covers the companies that process personal data on behalf of VIUZI ESP, SL (OnBio) to provide the service. For each company it states its function and the data it receives together with where it processes it and the safeguard that protects transfers outside the European Economic Area. It is part of the buyer data agreement and of the privacy policy. OnBio signs with each one a processing agreement under article 28 of Regulation (EU) 2016/679 with obligations equivalent to its own.
When we add or replace a sub-processor we publish a new version of this list and notify creators 30 days in advance. Each creator can object on data protection grounds at legal@onbio.es.
Sub-processors of the service
| Company | Purpose | Data | Where | Safeguard |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) | Hosting of the application and the cache, file storage, sending and receiving email and delivery of public files | All the data of the service | European Union (Ireland); public files, such as covers and avatars, are served from locations worldwide | Data in the EU; standard contractual clauses and EU-US Data Privacy Framework for support access |
| MongoDB Limited (Ireland) | Database | All the data of the service | European Union (Ireland) | Data in the EU; standard contractual clauses for support access |
| BunnyWay d.o.o. (Slovenia) | Hosting and playback of course videos | Videos uploaded by creators and the IP address of whoever plays them | European Union; playback is served from locations worldwide | Data in the EU |
| Functional Software, Inc. (Sentry, USA) | Error logging for the website, the server and the app | Technical identifiers and error data; contact and payment details are removed before sending | United States | EU-US Data Privacy Framework and standard contractual clauses |
| Google Ireland Limited (Firebase Cloud Messaging) | Notifications of the OnBio app for creators | Device identifier and notice text, without buyer data | European Union and United States | EU-US Data Privacy Framework and standard contractual clauses |
| Apple Distribution International Ltd. (Ireland) | Delivery of app notifications on iPhone and iPad | Device identifier and notice text | European Union and United States | EU-US Data Privacy Framework and standard contractual clauses |
| Meta Platforms Ireland Limited (WhatsApp Business) | WhatsApp messages with the access to a purchase and the notices the creator activates | Recipient’s phone number and message text | European Union and United States | EU-US Data Privacy Framework and standard contractual clauses |
Services the creator connects
These services only process data while a creator has them connected to their business from the panel. They stop receiving it as soon as the creator disconnects them or closes their business. With them OnBio exchanges, on the creator’s behalf, only the data each connection needs:
| Company | Purpose | Data | Where | Safeguard |
|---|---|---|---|---|
| Google Ireland Limited (Google Calendar) | Reading the creator’s availability and creating appointments | Date, time and email of whoever books | European Union and United States | EU-US Data Privacy Framework and standard contractual clauses |
| Microsoft Ireland Operations Limited (Outlook) | Reading the creator’s availability and creating appointments | Date, time and email of whoever books | European Union | Data in the EU; standard contractual clauses for support access |
| Zoom Communications, Inc. (USA) | Creating the video calls of sessions and events | Name and email of attendees | United States | EU-US Data Privacy Framework and standard contractual clauses |
| The Rocket Science Group LLC (Intuit Mailchimp, USA) | Syncing the creator’s contact list | Name, email and tags of contacts | United States | EU-US Data Privacy Framework and standard contractual clauses |
| Meta Platforms Ireland Limited (Instagram and Conversions API) | Replying to Instagram messages and measuring purchases from the creator’s ads | Instagram user and message; purchase event with identifiers of accepted cookies | European Union and United States | EU-US Data Privacy Framework and standard contractual clauses |
Who is not a sub-processor
Some companies receive data from OnBio or from users to provide their own service. They process it as independent controllers, under their own privacy policy, which is why they are not in the tables above:
- Stripe Payments Europe, Limited processes payments, pays creators and verifies their identity. It meets its own fraud prevention and anti-money-laundering obligations.
- Klarna Bank AB and PayPal (Europe) S.à r.l. et Cie, S.C.A., when the buyer pays with them.
- Google and Apple, when a person signs in with their account at those services.
- The Spanish Tax Agency (AEAT), which receives the invoicing records, and the European Commission, which checks VAT numbers in VIES.
OnBio locates the country of an IP address with a MaxMind database installed on its own servers. That lookup sends no data to MaxMind.