Sub-processors and service providers

This page accompanies our Privacy and Cookie Policy and the data processing agreement we conclude with business clients. It states which parties we engage, what role they perform, where they process, and on what basis data are transferred outside the European Economic Area.

We publish this overview on our own initiative, and not only on request, so that you can see with whom your data are shared before you entrust anything to us.

1. Two kinds of parties

It matters in what capacity we process your data, because that determines whom you should approach with a question.

Our own service providers. For the data we process for ourselves, such as website visits, contact requests, orders in our web shop, client administration and invoicing, we are the controller. The parties in table A process those data on our behalf.

Sub-processors. Where we build or manage a dashboard, data system or application for a business client, that client is the controller and we are the processor. The parties we engage in that context are sub-processors within the meaning of Article 28(4) of the General Data Protection Regulation. They are listed in table B.

If your data are held in a system we manage for an organisation, please approach that organisation. We will refer you on request.

2. Table A — Service providers for our own processing

Service provider	Role	Processing location	Basis for transfer outside the EEA
Shopify International Ltd.	Web shop, hosting and ordering platform	European Economic Area and United States	Standard contractual clauses
Payment service provider via Shopify Payments and the payment method you select	Handling of payments and chargebacks	European Economic Area	Not applicable
Google Ireland Ltd.	Website statistics via Google Analytics 4, only with your consent	European Economic Area and United States	Standard contractual clauses
Hostinger	Sending and receiving messages	European Economic Area	Not applicable
Gekko	Invoicing and administration	European Economic Area	Not applicable
Microsoft Ireland Operations Ltd.	File storage and collaboration via OneDrive, including quotations, order confirmations and client correspondence	European Economic Area	Standard contractual clauses under the Microsoft Products and Services Data Protection Addendum

In addition, we provide data to our accountant and, where the law so requires, to the Dutch Tax Administration or another competent authority. Those parties do not act on our behalf and are not processors.

3. Table B — Sub-processors for applications we build and manage for clients

Sub-processor	Role	Processing location	Basis for transfer outside the EEA
Hetzner Online GmbH	Running and deploying the application and storing back-ups: virtual servers, storage, network and back-up. This is where the application's data reside	European Economic Area	Not applicable
Anthropic PBC (Claude)	Supplies, via an application programming interface, the language model for the AI features in the application. Depending on what is agreed for each assignment, the model is obtained directly from Anthropic or within the EEA via a cloud platform	European Economic Area or United States, recorded per assignment in Annex A to the data processing agreement	Where processing takes place outside the EEA, the basis stated in Annex A to that assignment
Brevo	Sending notifications from the application	European Economic Area	Not applicable

Which of the parties in this table are actually engaged for a specific assignment is set out in Annex A to the data processing agreement concluded with that client. A sub-processor not listed there is not engaged for that assignment.

4. Transfers outside the European Economic Area

The applications we build and manage run on infrastructure within the European Economic Area, and the data held in those applications remain there.

Where a service provider nevertheless processes outside the EEA, this takes place on the basis of an adequacy decision of the European Commission or, failing that, on the basis of the standard contractual clauses, in both cases supplemented by measures such as encryption. The basis applicable to each party is stated in the final column of the tables above.

5. Providers of AI models

For an AI operation, only what is needed for that single operation goes to the provider's environment. The application itself and the data held in it do not travel with it.

We engage only providers who undertake contractually not to use the data for training, fine-tuning or improving their models.

In addition, providers retain the input and the output for a short period in order to counter misuse of their service. At Anthropic that period is currently no more than thirty days, unless a zero-retention arrangement has been agreed with us. If a provider changes that period, we amend this page.

6. Changes and how you are notified

We give notice of a new or replacement sub-processor at least thirty days in advance, stating the name, the role, the processing location and, where processing takes place outside the EEA, the basis for transfer.

That notice is given in two ways:

by publication on this page, stating the date on which the change takes effect;
by a message to the email address the client has provided for that purpose.

If you are a business client and wish to receive those messages, please provide the email address you would like us to use via info@bnkkam.com.

A client may object on reasonable grounds to a new sub-processor within those thirty days. What then applies is set out in Article 4.3 of the data processing agreement.

7. Record of changes

Version	Date	Change	Effective date
1.0	25 August 2026	First publication of this overview.	25 August 2026
1.1	26 August 2026	Service providers and sub-processors entered: Hostinger, Gekko, Microsoft Ireland Operations Ltd., Hetzner Online GmbH, Anthropic PBC and Brevo.	26 August 2026