Amazon Web Services
Amazon Web Services EMEA SARL, Luxembourg. Cloud hosting, databases, backups, logs, and system emails (Amazon SES). All customer data. AWS Frankfurt region, Germany.
Register governance
The accountable owner and applicable version.
The register is reviewed before a provider is appointed and whenever a provider, service, processing location, or transfer mechanism changes.
- Register owner
- Legal Advisor, codbex ltd
- Effective date
- 24 September 2026
- Last reviewed
- 24 September 2026
- Review frequency
- At least once a year, and before any provider is added, replaced, or changes its processing location.
Complete service chain
Customer data beyond the primary hosting provider.
A subprocessor is a provider that processes personal data on codbex ltd's behalf when codbex ltd acts as a processor for a customer. BusinessIntents stores all customer data with Amazon Web Services in the EU. Google Workspace is included because support correspondence sent to our mailboxes can contain customer data. Payment processing and website hosting are not subprocessing of customer data and are listed separately.
Current register
The providers, what they do, and where.
The register below reflects the providers in use on the date shown under Last reviewed.
Google Workspace
Google Cloud EMEA Limited, Ireland. Email for office@ and privacy@codbex.com. Support correspondence and any customer data sent by email. Google data centres, including outside the EEA.
Not subprocessors
Stripe processes subscription payments and GitHub hosts the public website. Neither receives customer data from the BusinessIntents service.
Change process
How supplier changes are handled.
codbex ltd publishes supplier changes on this page and gives customers a route to object.
Before appointment
A provider's security and data protection terms are reviewed, and a written agreement meeting Article 28 GDPR is in place before it processes customer data.
During service
Providers are reviewed at least once a year and whenever they change their services, locations, or terms.
At replacement or exit
Access is revoked, the provider returns or deletes the data under its contract, and this register is updated.
Subprocessor register
The register and the rules that govern it.
Each entry is confirmed against the current architecture and the provider's contract.
Current provider register
1. Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. Service: cloud infrastructure for the application, customer databases, file storage, backups, and service logs, and Amazon SES for system emails. Data subjects: customers' authorized users and every person whose data a customer enters in the service. Data: all customer data, including account, usage, and log data. Processing and storage: AWS Frankfurt region (eu-central-1), Germany. 2. Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. Service: Google Workspace email for office@codbex.com and privacy@codbex.com. Data subjects: customer representatives, authorized users, and people mentioned in correspondence. Data: names, email addresses, message content, and any customer data a customer chooses to include in an email. Processing and storage: Google data centres, which may be located outside the EEA.
Transfer safeguards
Customer data held in AWS is stored in Germany and is not transferred outside the EEA; the AWS Data Processing Addendum incorporates the European Commission's Standard Contractual Clauses for any access from outside the EEA. Google may process email data outside the EEA, including in the United States, relying on the EU–U.S. Data Privacy Framework and the Standard Contractual Clauses in the Google Workspace data processing terms. Customers can request details of these safeguards from privacy@codbex.com.
Security and privacy review
Before a provider may process customer personal data, codbex ltd reviews its security documentation, certifications, and data protection terms and concludes a written agreement that meets Article 28 GDPR, including confidentiality, security, assistance with data-subject requests and breaches, and deletion or return of data. Providers are reassessed at least once a year and whenever their service, location, or terms change.
Change notice
When codbex ltd intends to add or replace a subprocessor, it updates this page before the new provider begins processing customer personal data and changes the Last reviewed date. Customers are not notified individually and should check this page. A customer may object on reasonable data protection grounds by writing to privacy@codbex.com. codbex ltd will try to resolve the objection; if it cannot, the customer may terminate the affected subscription under the Terms of Service.
Provider removal
When a provider is removed, codbex ltd revokes its access, requires it to return or delete customer data under its contract, allows any backup copies it holds to expire, and removes it from this register.
Non-subprocessor recipients
Stripe Payments Europe, Limited (Ireland) processes subscription payments. It receives billing contact and payment details from the customer, not data from the BusinessIntents service, and acts as an independent controller for payment processing; Stripe may transfer data to the United States under the EU–U.S. Data Privacy Framework and Standard Contractual Clauses. GitHub, Inc. (USA) hosts the public website businessintents.com and processes visitors' IP addresses, not customer data. codbex ltd may also disclose data to professional advisers bound by confidentiality, to public authorities where the law requires it, and to third-party services that a customer chooses to connect; those recipients are not subprocessors.
Supplier evidence
Documents behind the register.
Documents that are not published here are provided on request, subject to the providers' confidentiality terms.
Approved provider registerThe register on this page is the current list. Contract and safeguard details are available on request from privacy@codbex.com.
Change-notification subscriptionNo subscription is offered. Changes are published on this page before they take effect; check the Last reviewed date.
Supplier assurance processSummarized above under Security and privacy review. More detail is available on request.
Related supplier information
The register matches every data disclosure.
Providers and locations match the hosting disclosure, privacy notice, and cookie notice.
Hub
Trust Center
Review the complete trust and legal library.
Open page →InfrastructureData hosting
Map providers to production, backup, log, email, monitoring, and support systems.
Open page →Personal dataPrivacy
Align recipients, transfers, purposes, retention, and rights.
Open page →WebsiteCookies
Identify third parties that receive website identifiers or usage data.
Open page →Subprocessor questions
Short answers to common subprocessor questions.
Which subprocessors does BusinessIntents use?
Two: Amazon Web Services EMEA SARL (Luxembourg) for hosting, databases, backups, logs, and system emails, and Google Cloud EMEA Limited (Ireland) for Google Workspace email correspondence.
Where do subprocessors process data?
All customer data in the service is processed and stored by AWS in the Frankfurt region, Germany. Email correspondence in Google Workspace may be processed in Google data centres outside the EEA under the EU–U.S. Data Privacy Framework and Standard Contractual Clauses.
How will customers learn about a new subprocessor?
This page is updated before a new provider begins processing customer personal data. Customers are not notified individually. Objections can be sent to privacy@codbex.com; if one cannot be resolved, the customer may terminate the affected subscription.
How are providers reviewed?
Before appointment, codbex ltd reviews each provider's security documentation and data protection terms and concludes an agreement meeting Article 28 GDPR. Providers are reassessed at least once a year and whenever their service, location, or terms change.
Supplier due diligence
Ask about the provider chain behind the service.
Send subprocessor questions and objections to privacy@codbex.com.
Subprocessor questions and objections: privacy@codbex.com. All other enquiries: office@codbex.com.