Sub-processors and other service providers
Last updated: 29 Oct 2026 · Version 2026-10-29
WorkLogx is operated by Monadion GmbH. To provide our services we use selected external providers. Where they process personal data on behalf of Monadion GmbH, they are engaged as sub-processors under Art. 28 GDPR and contractually bound accordingly.
Not every provider listed below is involved in every use of WorkLogx. Actual use depends on the features used and the technical configuration.
Certain providers act wholly or partly as independent controllers for particular processing operations. Those are listed separately.
Controller / provider:
Monadion GmbH
Schönbrunner Straße 181/1
1120 Vienna
Austria
Privacy contact: [email protected]
Support: [email protected]
Sub-processors
The following overview lists providers that may process personal data on behalf of Monadion GmbH in connection with operating the WorkLogx SaaS. Full legal entity details and contracts may follow the then-current provider documentation; the agreements concluded with each provider are decisive.
| Provider | Service | Purpose | Data concerned | Processing / region | Transfer mechanism |
|---|---|---|---|---|---|
| Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany | Compute/server hosting, PostgreSQL on Monadion’s Hetzner infrastructure, Hetzner Object Storage | Operation of WorkLogx backend, database, file/object storage, generated PDFs/exports, technical infrastructure | Tenant database content, user/account data, employee data, customer/project data, forms/submissions, files/photos/documents/signatures, technical metadata | Object Storage: region fsn1 (Falkenstein). Compute/PostgreSQL: currently verified as Hetzner Cloud FSN1, Germany | Processing in Germany / EU; Art. 28 DPA with Hetzner |
| Google LLC / Firebase (Google) | Firebase Authentication | Login, identity management, email/password authentication, MFA, authentication tokens | Name where supplied, email, Firebase UID, authentication metadata, MFA/security metadata, technical identifiers | Google infrastructure; processing may occur in the EEA and in third countries depending on the Firebase service and Google infrastructure | Firebase Data Processing and Security Terms; for restricted European transfers, applicable safeguards including SCCs where required |
| Expo (Expo Application Services) | Expo Push Service | Delivery of operational WorkLogx mobile push notifications (not advertising) | Expo push token, notification title/body/metadata, delivery receipts/errors, device/platform technical metadata | Expo infrastructure; delivery may involve Google FCM (Android) and Apple APNs (iOS) | Expo terms / DPA as applicable; Google and Apple act as delivery infrastructure for push |
| Google LLC | Firebase Cloud Messaging (FCM) | Android push delivery for Expo Push Notifications | Device push identifiers, notification payload metadata | Google infrastructure; may involve processing outside the EEA | Google / Firebase terms; used only for product/operational notifications |
| Apple Inc. | Apple Push Notification service (APNs) | iOS push delivery for Expo Push Notifications | Device push identifiers, notification payload metadata | Apple infrastructure | Apple Developer / APNs terms; used only for product/operational notifications |
| OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland | OpenAI API | Optional WorkLogx AI features where enabled/used (including Smart Builder, Voice Fill, Submission Review, Backoffice AI, AI-assisted planning/task suggestions) | Depending on feature: prompts/instructions, form schemas, field values, source documents, audio (Voice Fill), project/customer information, employee/planning information | Processing may occur in and outside the EEA; OpenAI’s sub-processor infrastructure is not limited to Ireland or the EEA | OpenAI DPA and applicable transfer mechanisms including SCCs where required |
| Microsoft | Microsoft Graph / Microsoft 365 | Transactional email delivery where configured/enabled (e.g. invitations, absence notifications, system messages) | Recipient email, recipient name, subject, message body, WorkLogx links/context included in the message | According to Monadion’s Microsoft tenant configuration and Microsoft’s applicable data-location commitments | Microsoft Products and Services Data Protection Addendum; transfer safeguards under the Microsoft agreement where required |
Notes:
- OpenAI is used only when the relevant AI feature is available for the customer account and used by the user/customer. Where technically implemented, the application sets API parameters such as
store: false. That means content is not stored persistently via that API feature; it does not by itself mean the provider is barred from all training use. The OpenAI business/API and data protection terms agreed with the provider are decisive. - Microsoft Graph is used only where the Graph mail integration is configured and enabled.
Other recipients / independent controllers
For certain services the provider processes personal data partly or wholly for its own purposes and is therefore not exclusively a sub-processor of Monadion.
Stripe
Provider (for Austrian customers among others): Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland, and other Stripe entities depending on the payment service provided.
Purpose: subscription billing, checkout, invoices, VAT/tax information, payment processing, payment/fraud security.
Potential data: billing name, email, billing address, VAT ID, Stripe customer/subscription IDs, payment metadata, transaction status.
Role: Stripe distinguishes, depending on purpose, between processing as Data Processor and as Data Controller. Stripe is therefore not exclusively a WorkLogx sub-processor.
Location / transfer: Stripe may process data globally and may transfer data to the United States and other jurisdictions under its applicable Data Transfers Addendum / transfer safeguards.
WorkLogx does not store full payment-card data.
Google Places / Google Maps Platform
Provider: Google
Service: Google Places / Google Maps Platform
Purpose: address autocomplete / address suggestions.
Potential data: typed address fragments, technical request metadata.
Important: The WorkLogx mobile app does not use Google Places for GPS tracking. Users enter addresses manually; typed fragments may be sent to Google to obtain address suggestions.
Role: For EEA customers, separate Google Maps Platform EEA terms and Controller-Controller Data Protection Terms apply. Google Places is not automatically classified here as an Art. 28 sub-processor of Monadion.
Website and marketing providers
These services are not part of the WorkLogx tenant-data sub-processor chain merely because they appear on or are prepared for the public marketing website. They do not process SaaS tenant data of the WorkLogx application under app.worklogx.com.
Cloudflare (marketing website / DNS)
Cloudflare is used for DNS of WorkLogx hostnames. The public marketing website (worklogx.com / www.worklogx.com) is currently delivered via Cloudflare (proxied). The SaaS hostnames app.worklogx.com and api.worklogx.com are currently DNS only and do not route application HTTP traffic through Cloudflare; they point to Hetzner infrastructure.
Purpose: DNS and — for the marketing website — network/security services and delivery.
Data: DNS/network metadata; for the marketing website also request metadata of website traffic. Not classified as a processor of all WorkLogx tenant content via app/api.
EU-only processing is not claimed unless Cloudflare Regional Services / Data Localization are separately purchased and enabled.
Google Tag Manager / Google Analytics 4
Purpose: website analytics and marketing performance measurement, where configured on the marketing website.
Rules:
- marketing website only,
- only after valid consent for the relevant cookie category,
- no marketing tracking inside
app.worklogx.com, - rejection prevents optional analytics tags from firing,
- cookie settings remain changeable later.
As of this list, Google Tag Manager is not recognisably configured as active on the public marketing website. If GTM/GA is enabled later, use remains consent-based on the marketing website only.
Meta Pixel and LinkedIn Insight Tag are not listed as active services until they are enabled in production.
Changes
Monadion may change or add sub-processors where required to provide and further develop WorkLogx.
Where WorkLogx processes personal data as a processor, we inform affected customers of material sub-processor changes in accordance with the agreed data processing agreement.
An objection may be sent within the period provided in the data processing agreement, on legitimate data protection grounds, to [email protected].
Contact
Questions about sub-processors and data protection may be sent to:
Monadion GmbH
Schönbrunner Straße 181/1
1120 Vienna
Austria
Last updated: 29 Oct 2026 · Version 2026-10-29