Subprocessors & Vendors
Transparency about the third-party providers we use. Draft — Prelaunch Legal Content.
Draft Notice: This subprocessor list is a prelaunch draft. Providers marked as "under evaluation" are not active subprocessors — they are candidates we are researching. Non-EU providers marked "exception-required" or "avoid" are not configured. This page will be updated as our vendor relationships change.
Temporary legal operator: Total Chaos is a trading name operated by Audio Lumina until the dedicated Total Chaos company registration is completed.
Our Approach
Total Chaos prefers EU/EEA-based providers and self-hosted or static solutions wherever practical. We believe this reduces transfer risk, simplifies compliance, and supports European digital infrastructure. Non-EU tools are used only as documented exceptions when no suitable EU alternative exists.
Before engaging any new provider, we review: company ownership, data hosting location, support staff locations, DPA availability, subprocessor transparency, and transfer risk. See our EU Vendor Policy (internal) for the full framework.
Currently Active
These are the only providers currently processing data on our behalf:
Easyhost
Website hosting, domain registration, and email mailbox provision
Data categories: Server logs (IP, timestamp, URL, user agent); Email content (if mailbox used)
Ownership: Belgian company, headquartered and operated in Belgium.
Hosting: Servers in Belgium. Data does not leave the EU/EEA.
Privacy policy: https://www.easyhost.be/privacy
Notes: Our hosting provider. The website is fully static; no application database stores personal data.
EU/EEA Candidates Under Evaluation
These providers are being researched as potential EU/EEA alternatives. They are not currently active and no data is being transferred to them.
Hetzner Online
VPS, dedicated servers, object storage, and backup
Data categories: Server logs; Customer data; File storage
Ownership: German company (Hetzner Online GmbH).
Hosting: Data centers in Germany (Nuremberg, Falkenstein) and Finland. EU-only hosting available.
Transfer risk: low
DPA status: pending
Privacy policy: https://www.hetzner.com/legal/privacy-policy/
Notes: EU/EEA hosting candidate under evaluation. Not currently active.
OVHcloud
VPS, dedicated servers, object storage
Data categories: Server logs; Customer data; File storage
Ownership: French company (OVH Groupe SA).
Hosting: Data centers in France, Germany, Poland, and other EU locations.
Transfer risk: low
DPA status: pending
Privacy policy: https://www.ovhcloud.com/en-ie/personal-data-protection/
Notes: EU/EEA hosting candidate under evaluation. Not currently active.
Scaleway
VPS, object storage, managed databases
Data categories: Server logs; Customer data; File storage
Ownership: French company (Scaleway SAS).
Hosting: Data centers in France. EU-only hosting by default.
Transfer risk: low
DPA status: pending
Privacy policy: https://www.scaleway.com/en/privacy-policy/
Notes: EU/EEA hosting candidate under evaluation. Not currently active.
Bunny.net
Content delivery network and object storage
Data categories: Static files; Access logs; Traffic metadata
Ownership: Slovenian company (BunnyWay d.o.o.).
Hosting: CDN PoPs globally, but company is EU-based. Storage regions include EU.
Transfer risk: medium
DPA status: pending
Privacy policy: https://bunny.net/privacy/
Notes: EU-based CDN candidate under evaluation. Not currently active.
Mollie
Payment processing, subscriptions, and payment links
Data categories: Payment information; Billing address; Transaction records
Ownership: Dutch company (Mollie B.V.).
Hosting: EU-based infrastructure. Verify exact hosting locations in DPA.
Transfer risk: low
DPA status: pending
Privacy policy: https://www.mollie.com/en/privacy
Notes: EU/EEA payment processor under evaluation. Not currently active.
Adyen
Enterprise payment processing
Data categories: Payment information; Billing address; Transaction records
Ownership: Dutch company (Adyen N.V.). Publicly listed in the Netherlands.
Hosting: EU-based infrastructure with global reach. Verify data residency options.
Transfer risk: low
DPA status: pending
Privacy policy: https://www.adyen.com/policies-and-disclaimer/privacy-policy
Notes: EU/EEA enterprise payment processor under evaluation. Not currently active.
Plausible Analytics
Privacy-focused website analytics
Data categories: Anonymized page views; Referrer; Device type; Browser type
Ownership: Estonian company (Plausible Insights OÜ).
Hosting: Cloud-hosted option uses EU servers. Self-hosted option is also available.
Transfer risk: low
DPA status: pending
Privacy policy: https://plausible.io/privacy
Notes: EU-based, privacy-focused analytics candidate under evaluation. Not currently active.
Matomo
Self-hosted or cloud-hosted web analytics
Data categories: Page views; Referrer; Device type; Browser type; Event data
Ownership: New Zealand origin, but Matomo Cloud is operated via EU entities. Self-hosted is fully controlled by us.
Hosting: Self-hosted: on our own EU server. Cloud: verify hosting location in DPA.
Transfer risk: low
DPA status: pending
Privacy policy: https://matomo.org/privacy-policy/
Notes: Analytics candidate under evaluation. Self-hosted option preferred for full data control. Not currently active.
Brevo (formerly Sendinblue)
Transactional and marketing email delivery
Data categories: Email address; Message content; Delivery metadata
Ownership: French company (Brevo SAS).
Hosting: EU-based infrastructure. Verify exact data-center locations in DPA.
Transfer risk: low
DPA status: pending
Privacy policy: https://www.brevo.com/legal/privacypolicy/
Notes: EU/EEA email provider under evaluation. Not currently active.
Tally
Form creation and submission handling
Data categories: Form responses; Email; Metadata
Ownership: Belgian company. Needs verification of legal entity and hosting.
Hosting: Claimed EU-based. Must verify actual server locations and DPA terms.
Transfer risk: unknown
DPA status: pending
Privacy policy: https://tally.so/privacy
Notes: Belgian form tool under evaluation. Hosting and data processing details need verification. Not currently active.
Non-EU Tools Not Used by Default
These providers are marked as exception-required or avoid. They are not configured and will only be considered if no suitable EU/EEA alternative exists, with a documented exception, signed DPA, and Standard Contractual Clauses where required.
Formspree
Form submission processing
Data categories: Name; Email; Organization; Message content; Form metadata
Ownership: US company.
Hosting: US-based infrastructure. Data transfer to the US required.
Transfer risk: high
DPA status: needed
Privacy policy: https://formspree.io/legal/privacy-policy/
Notes: Non-EU form provider. Not used by default. Would require documented exception, DPA, and Standard Contractual Clauses.
Stripe
Payment processing for software licenses
Data categories: Payment information; Billing address; Transaction records
Ownership: US/Irish company (Stripe, Inc. / Stripe Payments Europe, Ltd.). Irish entity processes EU transactions, but parent is US.
Hosting: EU transactions may be processed by Stripe Payments Europe, Ltd. Verify actual data residency and subprocessor locations.
Transfer risk: medium
DPA status: needed
Privacy policy: https://stripe.com/privacy
Notes: Non-EU payment provider with an Irish subsidiary. Not used by default. Would require documented exception and DPA review.
Lemon Squeezy
Payment processing, tax handling, and license fulfillment
Data categories: Payment information; Customer email; License records; Tax data
Ownership: US company (Lemon Squeezy, LLC).
Hosting: US-based infrastructure.
Transfer risk: high
DPA status: needed
Privacy policy: https://www.lemonsqueezy.com/privacy
Notes: Non-EU Merchant of Record provider. Not used by default. Would require documented exception and DPA review.
Cloudflare
DNS, CDN, DDoS protection, edge functions
Data categories: Server logs; Traffic metadata; DNS queries
Ownership: US company (Cloudflare, Inc.).
Hosting: Global CDN. All traffic passes through Cloudflare infrastructure, including non-EU PoPs.
Transfer risk: high
DPA status: needed
Privacy policy: https://www.cloudflare.com/privacypolicy/
Notes: Non-EU CDN/DNS provider. Not used. If ever needed, would require documented exception, DPA, and SCCs.
Google Analytics
Website usage analytics
Data categories: Page views; User behavior; Device data; Demographics
Ownership: US company (Google LLC).
Hosting: US-based infrastructure. Complex data flows and subprocessors.
Transfer risk: high
DPA status: needed
Privacy policy: https://policies.google.com/privacy
Notes: Not used. We prefer EU-based, privacy-focused analytics tools.
Vendor Selection Principles
- EU/EEA first — Prefer providers headquartered, hosted, and legally governed in the EU/EEA.
- Minimal data — Collect and transfer only what is necessary.
- Self-hosted/static where practical — Our website is fully static, reducing vendor dependencies.
- DPA before production — No personal data is transferred to a new provider until a DPA is reviewed.
- Transparency — All providers are listed publicly on this page.
Data Transfers
No international data transfers are currently occurring. All active processing happens within Belgium/EU via Easyhost. If we engage a provider outside the EU/EEA in the future, we will do so under appropriate safeguards such as Standard Contractual Clauses (SCCs) or an adequacy decision.
DPA and Review Status
Every active subprocessor must have a reviewed Data Processing Agreement (DPA) or equivalent contractual terms before personal data is transferred. Under-evaluation providers are researched for DPA availability as part of the selection process.
Changes to This List
We will update this page when providers are added, removed, or change status. For material changes to active subprocessors, we will notify affected users directly where required by law.
Contact
Questions about subprocessors? Contact us at privacy@totalchaos.be.
Audio Lumina
Lodewijk Van Veltemstraat 57, 3020 Veltem-Beisem
Belgium
Effective date: 2026-06-03