Legal
Sub-processors
This English text is a translation provided for information. In case of any difference, the Hungarian version prevails.
Annex 2 to the General Terms and Conditions (ÁSZF, hereinafter: the “Terms”). Effective from: 12 November 2026. Operator (hereinafter: the Provider): Tálosné Tomisa Erika e.v..
1. What this list is for
1.1. For the personal data uploaded by the Customer to the Routehive service or generated there (the work-related data of recipients, partners and drivers, live location, delivery photo and signature), the Customer is the controller and the Provider is its processor. For this purpose, the Provider engages the sub-processors (subcontractors) listed below. By accepting the Data Processing Agreement (Annex 1 to the Terms), the Customer gives a general authorisation for their engagement (Article 28(2) GDPR).
1.2. Section 3 lists the service providers that the Provider engages for its own processing activities (accounts, invoicing, communication with customers). These are also covered by the Privacy Notice.
1.3. The “Legal basis for transfer” column shows what makes it lawful if the data is transferred outside the European Economic Area (EEA), typically to the United States, or is accessible from there:
- Data Privacy Framework (DPF): European Commission Implementing Decision (EU) 2023/1795 on the EU-US Data Privacy Framework; data may be transferred to a US company certified under the framework without any separate authorisation.
- Standard contractual clauses (SCC): the contractual clauses under Commission Implementing Decision (EU) 2021/914, which form part of the sub-processor's data processing addendum. As a fallback safeguard in case the framework ceases to exist.
- The certification must be checked on the dataprivacyframework.gov list before going live and every year.
2. Sub-processors processing Customer Data
| Sub-processor | Task | Data categories | Location | Legal basis for transfer |
|---|---|---|---|---|
| Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA): Workers | Running the application, serving requests over an encrypted (HTTPS) connection, scheduled tasks (creating recurring routes) | All data contained in a request, only for the duration of processing | Cloudflare's global network: a request is typically served by the data centre nearest to the user. For users in Hungary this is usually in the EU, but this is not guaranteed | DPF, with SCC as a fallback (Cloudflare's data processing addendum, DPA) |
| Cloudflare, Inc.: D1 database | Persistent storage of data | Accounts and company memberships, routes, stops, partners, fixed routes, delivery events, crate movements, proof of delivery data (without the file), deletion log, application log | EU: database created under EU jurisdiction (jurisdiction: eu) | Storage in the EU. For any access by the US parent company: DPF, with SCC as a fallback |
| Cloudflare, Inc.: R2 file storage | Storing files | Delivery photos and signature images, the company logo | EU: storage created under EU jurisdiction | As for D1 |
| Cloudflare, Inc.: Containers (route planner) | Optimising the order of the stops, calculating the route's driving time, distance and map line | The coordinates of the depot and the stops (without name, address or telephone number), only for the duration of the request. The container does not log the coordinates; its temporary disk is erased when the container stops | EU: container running under EU jurisdiction (currently Vienna) | Processing in the EU. For any access by the US parent company: DPF, with SCC as a fallback |
| Cloudflare, Inc.: Workers KV | Fast access to short-lived data | The driver's live location (coordinates, accuracy, time, the name of the route and of the driver), for 10 minutes; attempt counters (e-mail address or account ID, IP address), for 15-60 minutes; address search cache (address and coordinates, without any data referring to the company), for 30 days | EU (namespace under EU jurisdiction, since 2026-10-30) | DPF, with SCC as a fallback |
| Cloudflare, Inc.: Workers Logs (operational log) | Troubleshooting, operations | Technical log of requests and errors; may contain a user ID, the page address and, for an unsuccessful address search, the address searched for | Not restricted to the EU | DPF, with SCC as a fallback; retention according to the Cloudflare plan, for a maximum of 7 days |
| Google (Google Maps Platform), contracting party: the Google company under the Google Cloud account agreement (parent company: Google LLC, USA) | Address search and address autocomplete (Geocoding API, Places). The map and route planning do not run on Google (own map and route planner, OpenStreetMap data, on Cloudflare) | The addresses of the stops; the text typed into the search field; the IP address and technical data of the browser using address autocomplete. The Provider does not send names, telephone numbers or amounts to Google | Google's global data centres, including in the USA | DPF, with SCC as a fallback. Google acts in accordance with the Google Maps Platform data protection terms |
| stableserver.net (WHG Hosting Services Ltd, Egyesült Királyság; a szerver Frankfurtban) | System e-mails (e-mail address confirmation, invitation, forgotten password); later, notifications to the recipient | The recipient's e-mail address and name, the content of the message (e.g. company name, time, tracking link) | Germany (Frankfurt, EU) | Within the EU, not required |
| MailChannels Corp. (Canada) | Relaying outgoing e-mails to the recipient's mail server (the e-mail provider's relay and spam-filtering service) | The recipient's e-mail address, the content of the message | Canada, USA | Canada: Commission adequacy decision (2002/2/EC); otherwise standard contractual clauses (SCC) |
| APPON LINE Kft. (SimpleSMS; 2120 Dunakeszi, Római utca 1/1.) | Notifying the recipient by SMS (e.g. expected arrival, tracking link) | The recipient's telephone number, the text of the message | Hungary (EU) | Within the EU, not required |
Notes:
- SMS notifications are currently not available; the SMS provider receives data only if the Customer switches SMS notifications on, and we send the notification under Section 5 before they are introduced.
3. Processors engaged for the Provider's own processing activities
These do not process Customer Data, but the Provider's own customer and invoicing data (Privacy Notice).
| Service provider | Task | Data categories | Location | Legal basis for transfer |
|---|---|---|---|---|
| Cloudflare, Inc. (as in Section 2) | Storing and serving accounts, sessions and logs | User accounts, sessions (IP address, browser), encrypted two-step login data, application log | As in Section 2 | As in Section 2 |
| stableserver.net (WHG Hosting Services Ltd, Egyesült Királyság; a szerver Frankfurtban) | System e-mails to Users | E-mail address, name, the content of the message | Germany (Frankfurt, EU) | Within the EU, not required |
| MailChannels Corp. (Canada) | Relaying outgoing e-mails to the recipient's mail server (the e-mail provider's relay and spam-filtering service) | The recipient's e-mail address, the content of the message | Canada, USA | Canada: Commission adequacy decision (2002/2/EC); otherwise standard contractual clauses (SCC) |
| Stripe (Stripe Payments Europe, Ltd., Ireland) | Collecting the subscription fee, managing the subscription, customer portal | Billing name and address, tax number, e-mail address, payment details, the number of stops above the allowance. Bank card data is processed only by Stripe | EU, also at Stripe's group companies in the USA | Stripe's data processing terms, EU-US Data Privacy Framework (DPF) |
| Számlázz.hu (KBOSS.hu Kft.) | Issuing invoices, reporting data to the National Tax and Customs Administration (NAV), sending the invoice by e-mail | The Customer's company details, the billing e-mail address, the invoice items | Hungary | Within the EU, not required (the data processing terms of Számlázz.hu) |
| The Provider's accountant | Bookkeeping, tax returns | The invoices and the related data | Hungary | Within the EU, not required |
| stableserver.net (WHG Hosting Services Ltd, Egyesült Királyság; a szerver Frankfurtban) | Operating the info@routehive.eu mailbox (customer service correspondence) | The sender, content and attachments of the messages | Germany (Frankfurt, EU) | Within the EU, not required |
4. Services that are not processors but affect the data
- GitHub, Inc.: stores only the source code of the Service. No Customer Data, personal data or secret keys are placed there.
- Google Sheets import: if the Customer enters, on the interface, its own Google Sheet shared by link, the Service downloads the sheet from Google at the Customer's request. The sheet is stored within the legal relationship between the Customer and Google.
- Navigation on the driver's phone: the “Navigation” button in the driver interface opens Google Maps with the destination address. Google Maps is used within the legal relationship between the driver (or the Customer) and Google. The same applies if the dispatcher views the driver's location on Google Maps using the “open on map” link.
5. Notification of changes
5.1. The Provider notifies the Customer's owners by e-mail at least 30 days before the change about the engagement of a new sub-processor or the replacement of a sub-processor, and updates this list. The Customer may object to the change in accordance with Section 11 of the Data Processing Agreement.
5.2. Change log:
| Date | Change |
|---|---|
| 12 November 2026 | First version |