Subprocessors

To operate and maintain the platform, Lumi Education UG (haftungsbeschränkt) uses selected service providers (subprocessors) that process personal data on our behalf. All subprocessors are carefully selected and contractually bound through Data Processing Agreements (Art. 28 GDPR). They process personal data only according to our documented instructions and must implement appropriate technical and organizational security measures.

Current Subprocessors

The following subprocessors may process personal data as part of operating the platform.

Provider

Role

Service

Purpose of Processing

Data Categories

Data Location

Transfer Mechanism

Hetzner Online GmbH

Subprocessor

Cloud infrastructure

Hosting of application servers and core infrastructure

Account data, learning data, technical logs

Germany (Nürnberg)

Not applicable

Scaleway SAS

Subprocessor

Cloud infrastructure

Additional hosting infrastructure and services

Account data, learning data, technical logs

France (Paris)

Not applicable

MongoDB

Subprocessor

Database service

Storage and processing of application data

Account data, learning content

Germany (Frankfurt)

Not applicable

Redis

Subprocessor

In-memory database / caching

Performance optimization and temporary data storage

Technical data, session data

Germany (Frankfurt)

Not applicable

FusionAuth

Subprocessor

Authentication platform

User authentication and identity management

Login credentials, user identifiers

EU

Not applicable

Brevo (Sendinblue)

Subprocessor

Email delivery

Sending transactional emails (verification, password reset, notifications)

Email address, notification content

EU

Not applicable

Cloudflare, Inc.

Subprocessor

DNS and CDN services

DNS resolution, caching, performance and security protection

IP addresses, technical connection data

EU / Global

Standard Contractual Clauses (SCC)

FastSpring

Merchant of Record / Payment Provider

Payment processing

Billing, payment processing, tax handling

Billing data, customer contact data, payment details

EU / USA

Standard Contractual Clauses (SCC)

Termly

Subprocessor

Cookie consent management

Display and management of cookie consent banner

IP address, consent records

EU / USA

Standard Contractual Clauses (SCC)

heyData GmbH

Subprocessor

Data protection management

GDPR compliance management and documentation

Administrative data

EU

Not applicable

Categories of Data Processed by Subprocessors

Depending on the service used, subprocessors may process the following categories of personal data.

Account Data

  • name

  • email address

  • user identifiers

Learning Data

  • educational content created by users

  • answers and submissions

Technical Data

  • IP addresses

  • authentication logs

  • system diagnostics

  • session data

Billing Data (FastSpring)

  • billing address

  • email address

  • payment information

  • transaction details

Subprocessors only receive the minimum amount of data necessary to provide their services.