1. The list
These are the providers that OutLine Digital Agency uses to provide Omega People. They are engaged as processors and bound by contract to obligations equivalent to those of the Data Processing Agreement.
| Provider | Activity | Where it processes data | Outside the EEA |
|---|---|---|---|
| IONOS SE | Servers and storage: hosts the application, the workspace databases, uploaded files (employee documents, payslips, receipts, attachments) and backups. | Germany | No |
| Aruba S.p.A. | Relays the service’s outgoing email: invitations to employees and team members, password resets, messages to job candidates, emails sent by the automation rules the customer sets up, and subscription emails. Messages contain the recipient’s name and email address and the content of the message. | Italy | No |
| Stripe Payments Europe, Limited | Collects subscription payments and issues receipts. It processes only the billing details of the subscriber (company name, address, VAT number, billing email, card details — which never pass through our servers). With them it receives the name of the workspace, the sign-in email address of its owner and our internal reference numbers. It has no access to the data stored in workspaces. | Ireland | No |
No sub-processor processes your workspace data outside the European Economic Area. Stripe, for subscription payment data only, may also use Stripe, Inc. in the United States under the EU-U.S. Data Privacy Framework (see the Privacy Policy).
2. Why the list is so short
Three providers is few for a cloud service: every extra name is one more party that sees customers’ data. The short list is the result of deliberate, verifiable choices:
- no third-party analytics or tracking tools;
- no external content delivery network for the website and the screens of the application: images, scripts and fonts are served from our own domain (the few cases in which a browser loads something from elsewhere are listed in section 4);
- no external support, chat, ticketing or error-reporting service: errors stay in our logs, on our servers;
- no artificial-intelligence provider at platform level: AI features are off by default and, when a customer switches them on, they run either in the user’s browser or with the customer’s own provider and key;
- no e-signature provider of ours: remote signature uses the customer’s own Yousign account;
- no push-notification service: notifications are shown inside the application and the mobile app when they are opened;
- no marketing email service: the only email we send is service email (invitations, password resets, messages to candidates, the emails of the customer’s automation rules, billing), through a single relay.
3. If this list changes
- The addition or replacement of a sub-processor is announced at least 30 days in advance, by email to the account address and with a notice in the application.
- Within that period the customer may object on reasonable, documented data protection grounds.
- If it objects, we look in good faith for an alternative; if none is practicable, the customer may terminate without penalty with effect from the date of the change.
4. What is NOT on this list, and why
Services you connect yourself. Omega People can work with services that you choose and contract for: Yousign for electronic signatures, with the API key of your own Yousign account (the document to be signed and the signer’s name, email address and phone number are sent to it); an artificial-intelligence provider — Anthropic, OpenAI or Google — with your own key, if you switch AI features on in that mode (see Artificial Intelligence); and webhooks that your automation rules call. These are not our sub-processors: you choose them, the contract is yours, and the data goes there on your instruction. They belong in your own record of processing.
OpenStreetMap. When an administrator asks the application to find a site on the map, the address of the site is sent to OpenStreetMap’s public search service, and the map images are loaded by the administrator’s browser from OpenStreetMap’s servers. The position recorded at clock-in is compared with the site on our own servers, without any map service; only if a manager chooses “view on the map” for a clock-in does their browser open openstreetmap.org at those coordinates, without any name attached. The OpenStreetMap Foundation is therefore not a processor of your workspace data.
Exchange rates. To convert expenses in foreign currency, the application downloads the reference rates published by the European Central Bank or, if that source does not answer, by the public service frankfurter.dev. Only the currency and the date are sent: nothing about people.
Typefaces and videos on the pages you publish. Careers pages and websites built with the page editor load the typeface you choose from Google Fonts (unless you choose “System”) and any video you insert from YouTube or Vimeo. They are loaded by the visitor’s browser, not by us, and are described in the Cookie Policy.
Push notifications. Omega People does not send push notifications through any third-party service today. If they are introduced, the provider that delivers them will be added to this list with the notice set out in section 3.
Certificates for your own domain. If you publish a website on a domain of your own, the certificate that secures it is requested from Let’s Encrypt, which receives the name of the domain. No personal data is involved.
The QR-code scanner of the mobile app. The app reads QR codes on the device, with Google’s ML Kit library. Google states that the library sends it technical diagnostics — device model, operating system, app version, a per-installation identifier, error codes — and no images. Google receives no data from your workspace and is not our sub-processor; the detail is in section 14 of the Privacy Policy.
In the application, under Settings → Privacy and compliance, each customer finds its record of processing already filled in with what Omega People processes for it, the list of the services it has connected, and the privacy notices for its employees and candidates.