Skip to content

Subprocessors

The providers that process personal data for Galla, what they do, where, and the safeguard for any transfer outside the European Union. A provider is added or replaced only after owners are told in the back office and this page is updated, 30 days ahead; an organization may object (data processing agreement, section 3).

In force since Wednesday, October 21, 2026

These texts are drafts until a lawyer has reviewed them; the bracketed details are filled in before launch.

Google Cloud (Google Cloud EMEA Ltd, Ireland)

  • What: hosting of the application, the database, files, backups, secrets, logs and monitoring.
  • Data: everything organizations and staff keep in Galla.
  • Where: European Union (Belgium; backups in the Netherlands).
  • Safeguard: data stays in the EU; Google’s Cloud Data Processing Addendum, with the standard contractual clauses for any access from outside the EU.

Firebase Authentication with Identity Platform (Google Cloud EMEA Ltd, Ireland)

  • What: staff sign-in accounts.
  • Data: name, email address, password hash, and the Google or Microsoft account used to sign in.
  • Where: Google’s global infrastructure, including the United States.
  • Safeguard: the standard contractual clauses in Google’s Cloud Data Processing Addendum; Google LLC is also certified under the EU-US Data Privacy Framework.

Postmark (ActiveCampaign LLC, United States)

  • What: sending emails (invitations, reminders, account and billing emails).
  • Data: recipient address, the email’s content, and delivery, bounce and complaint events, kept 45 days.
  • Where: United States.
  • Safeguard: the standard contractual clauses in Postmark’s data processing addendum; ActiveCampaign is also certified under the EU-US Data Privacy Framework.

Stripe (Stripe Payments Europe Ltd, Ireland)

  • What: subscription billing, and card payments for tickets on an organization’s own Stripe account.
  • Data: billing contact, company and VAT number, invoices; for tickets, the buyer’s name, email address and payment. Card numbers go to Stripe only.
  • Where: European Union and United States (Stripe, Inc.).
  • Safeguard: the standard contractual clauses in Stripe’s data processing agreement; Stripe, Inc. is also certified under the EU-US Data Privacy Framework.

Chosen by the organization, not by Galla

An organization’s own email provider (when it sends from its own domain, mailbox or server), its own Stripe account, and its own Google or Microsoft single sign-on are chosen and contracted by the organization; Galla connects to them on its instructions.