Legal

Sub-processors

Everybody who touches attendee data on our behalf, named.

Last updated 25 August 2026

This is the complete list. It belongs to our data processing terms, which is where the commitment to keep it current is made.

Who they are

Vercel Inc.

Running the application itself.

  • Data sits in: Frankfurt, Germany (eu-central-1)
  • Company established in: United States
  • Transfer basis: Their data processing addendum, which incorporates the European Commission's standard contractual clauses.

Supabase

The database, and the files people upload.

  • Data sits in: Frankfurt, Germany (eu-central-1)
  • Company established in: Singapore, with a United States entity
  • Transfer basis: Their data processing addendum, which incorporates the European Commission's standard contractual clauses.

Resend

Sending email: ticket codes, notifications, password resets.

  • Data sits in: Ireland (eu-west-1)
  • Company established in: United States
  • Transfer basis: Their data processing addendum, which incorporates the European Commission's standard contractual clauses.

Anthropic PBC

The AI features. Text is sent to produce a result and is not used to train any model.

  • Data sits in: United States
  • Company established in: United States
  • Transfer basis: Their commercial terms and data processing addendum, which incorporate the European Commission's standard contractual clauses.

Roles nobody fills yet

Listed because their absence is worth knowing. A list that quietly omits a category leaves you to guess.

  • Payments: None. Where an event sells tickets today the money is handled outside B2Pair by the organiser.
  • Analytics: None, and this one is a choice rather than a gap.

Where we are, and why it matters

B2Pair is operated from Kosovo, which does not hold an adequacy decision from the European Commission. Attendee data is stored in Frankfurt, and we access it from Kosovo. That access is a restricted transfer, and it is covered by the standard contractual clauses in our data processing terms.

Two things that are not on this list

Your exhibitors

An exhibitor who scans an attendee’s badge is not our sub-processor and not yours. The attendee handed the card to them, deliberately, for their own purposes, which makes them a controller from that moment. Calling them a sub-processor would make you answerable for what every stand at your event does with a lead.

Anybody advertising or measuring

There is no analytics provider, no advertising network and no tag manager, which is why there is no consent banner. See cookies.

Changes to this list

We will tell organisers before adding a sub-processor that handles attendee data, with enough notice to object. The date at the top of this page is when the list itself last changed, not when the page was edited.

Verified against production on the date above: the database and the application both run in Frankfurt.