SUBPROCESSORS
nexantera AI – Robin Stute
Last updated: 1 July 2026 · Version 1.2
This list contains the sub-processors engaged by nexantera AI - Robin Stute (hereinafter "nexantera") in the provision of AI consulting and automation services. The list is maintained in accordance with Art. 28(2) and (4) GDPR and is made available to clients on request and as an annex to the data processing agreement (DPA).
Corresponding data processing agreements or Data Processing Addenda (DPAs) are in place with all providers listed below. Third-country transfers are safeguarded by EU Standard Contractual Clauses (SCCs), adequacy decisions or the EU-US Data Privacy Framework.
ANBIETER / Dienst | Zweck der Verarbeitung | Verarbeitete Datenkategorien | Sitz / Serverstandort | Rechtsgrundlage Drittlandtransfer |
|---|---|---|---|---|
Wix.com Ltd. | Hosting of the company website nexantera.de, contact form | Website visitor data (IP, browser meta), contact form entries (name, email, message) | Tel Aviv, Israel
Servers: USA / EU | Israel: Adequacy decision by the EU Commission; US subcontractors covered by SCCs |
Cal.com, Inc. (Cal.eu) | Online appointment booking for initial consultations and customer meetings | Name, email address, preferred date, optional answers to booking questions | San Francisco, USA (contractual partner) Server: EU (Cal.eu instance) | Cal.com, Inc. (USA), instance Cal.eu (EU). US processing possible, secured via SCC (Art. 46 GDPR) |
Anthropic, PBC | Provision of Claude language models for AI-supported processing (e.g., CV analysis, text generation) | Input and output texts according to workflow; any personal data contained therein | San Francisco, USA Server: USA (no EU training, no data storage beyond API default settings) | EU Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR; no use of customer data for model training |
OpenAI, L.L.C. | Provision of GPT language models and embeddings for AI-powered processing in workflows | Input and output texts according to workflow; any personal data contained therein | San Francisco, USA
Server: USA (API usage with customer data training disabled) | EU Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR; opt-out for model training is active. |
Google Ireland Ltd. (Google Workspace) | Business email (Gmail), file storage (Drive), appointment management (Calendar), spreadsheets (Sheets) | Email content, contact details, documents, calendar entries, metadata | Dublin, Ireland (EU partner)
Server: global, primarily EU/USA | EU contractual partner; Google has been certified under the EU-US Data Privacy Framework since 2023; additionally, SCC. |
n8n GmbH
(n8n Cloud)
| Workflow automation, orchestration of automation processes for customer projects | Depending on the workflow: contact details, applicant and candidate data, email content, metadata | Berlin, Germany
Server: EU (Frankfurt)
| None — EU providers with servers located in the EU |
-
Project-specific sub-processors: In individual client projects, additional services specified by the client or agreed jointly may be used (for example ATS systems, CRM platforms). These are documented separately in the respective project contract or a project annex.
-
Changes: nexantera AI informs clients in good time of any planned addition or replacement of sub-processors and grants a right to object in accordance with the provisions of the DPA.
-
Data minimisation: Personal data is transferred to sub-processors only to the extent necessary for the respective processing. Where technically possible, data is processed in pseudonymised or anonymised form.
-
AI models: With OpenAI and Anthropic, the use of input data to train the models is excluded contractually and via the API configuration.
Contact for data protection enquiries
nexantera AI – Robin Stute
E-Mail: rstute@nexantera.de
Phone: 05641/4054574
Website: www.nexantera.de