Sub-processors
Current as of 2026-09-22
This page lists the third parties that Apex Academy d.o.o. engages to process personal data on behalf of Digital Worker customers under our Data Processing Agreement. Every customer instance is hosted in the European Union. If the Croatian and English versions differ, the Croatian version prevails.
Hosting providers
| Provider | Service | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
|
netcup netcup GmbH, Karlsruhe, Germany, and the Anexia group entities it engages: Anexia Holding GmbH (Klagenfurt, AT); Anexia Cloud Solutions GmbH (Klagenfurt, AT); Anexia Cloud Solutions GmbH (Karlsruhe, DE) |
Dedicated server hosting and snapshots; hosts new instances | All instance data at rest and in transit on the server | Nuremberg, Germany (EU); Vienna, Austria (EU) | Within the EU; no third-country transfer |
|
Hostinger Hostinger International Ltd. |
Server hosting for existing instances until they are migrated to netcup | All instance data at rest and in transit on the server | Frankfurt, Germany (EU) | Within the EU; no third-country transfer |
Migration in progress. New instances are hosted with netcup. Instances still hosted with Hostinger will be moved to netcup; each affected customer is notified at least 30 days before its instance is migrated. This page is updated when Hostinger no longer holds customer data.
Services you choose
AI model providers (for example OpenAI, Anthropic, Google or a self-hosted model), messaging channels (for example WhatsApp, SMS, Slack, Microsoft Teams, Telegram), email delivery, identity providers for single sign-on, and every other integration are chosen and connected by each customer with its own keys or accounts, under its own contract with that provider. They are not our sub-processors and are therefore not listed here. The customer, as controller, decides whether and what data is sent to them.
Where we supply AI usage ourselves (for example during onboarding), the Order Form names the provider, the period and the transfer safeguard, and that provider is our sub-processor for that period only.
Self-hosted components (not sub-processors)
The following run inside each customer's instance, on the same server, and are operated by Apex Academy d.o.o., not by a third party:
- MySQL — application database
- Redis — rate limiting, job queue
- Qdrant — vector database for retrieval-augmented generation
Notifications and objections
We announce changes to this list by email to each customer's administrative contact at least 30 days in advance where the change is within our control, and otherwise as soon as practicable after the provider concerned notifies us. To object to a new sub-processor, contact legal@apexacademy.hr within the notice period.