Trust Center
SubprocessorsWho processes data in the chain.
Hardly any platform works without specialized providers, so the GDPR requires transparency about who processes personal data on your behalf. Here is what that means and how you get the current AirLST subprocessor list.
01Rules
What the GDPR requires for subprocessors
01
Only with authorization
A subprocessor needs the controller's authorization; in practice through the DPA.
Source: GDPR Article 28(2)02
The same obligations
The subprocessor is bound by contract to the same data protection obligations as AirLST.
Source: GDPR Article 28(4)03
Responsibility stays
AirLST remains responsible to you for the whole chain.
Source: GDPR Article 28(4)02The list
The current list comes with the DPA
We do not publish a copy on the website, so your privacy team always works with the binding, current version.
- 01
With the DPA
The list is part of the documents of the data processing agreement; see GDPR.
- 02
On request
Ahead of your vendor review at kontakt@airlst.com.
- 03
Hosting is known
The platform runs on Amazon Web Services in Germany; see data hosting.
03Read on
More in the trust center
04FAQ
Subprocessors FAQ
What is a data subprocessor under the GDPR?
A subprocessor is a third party that a data processor (here AirLST) engages to process personal data on behalf of its customer, for example a hosting or email delivery provider. Under GDPR Article 28(2) and 28(4), a processor may only use a subprocessor with the controller’s authorization and must bind it to the same data protection obligations.
Is a subprocessor the same as a subcontractor?
Not quite. Every subprocessor is a subcontractor, but not every subcontractor is a subprocessor. The term applies only when the subcontractor processes personal data on the processor’s behalf. A vendor that never touches your guests’ personal data is a subcontractor, but not a subprocessor.
Where can I find the current list of AirLST subprocessors?
AirLST provides the current list on request and as part of the data processing agreement (DPA). Email kontakt@airlst.com or use the contact form.
Will we be notified when subprocessors change?
The data processing agreement usually defines how new or replaced subprocessors are announced and how the controller can object; the AirLST DPA sets out that process.
Do subprocessors process data outside the EU?
The AirLST platform is hosted in Germany, see data hosting in Germany. Whether individual further providers process data outside the EU, and with which safeguards, is stated in the list that comes with the DPA.