Sub-processors

What this list is

When an organiser uses Bicyr Cangor, we process their guests’ and buyers’ personal data for them, as their processor (organiser terms, section 2). These are the companies we use to do that. By accepting the organiser terms, an organiser authorises us to use them.

We tell organisers at least 15 days before we add or replace one. An organiser may object, and if we cannot accommodate the objection the organiser may end the organiser terms.

Our sub-processors

• MongoDB, Inc. (MongoDB Atlas) — the database in which the platform’s records are kept. The data is stored in the EU, in Frankfurt, Germany (AWS eu-central-1). Any access by MongoDB from outside the European Economic Area falls under MongoDB’s data processing agreement (21 October 2024), which relies on MongoDB’s certification under the EU-US Data Privacy Framework and, as a fallback, on the European Commission’s standard contractual clauses.
• Cloudflare, Inc. (Workers and Containers) — the servers that run the platform. The application container runs in the EU; Cloudflare’s network, which carries requests to it, is worldwide. Safeguard for transfers: Cloudflare’s data processing agreement (version 6.4), including the EU Standard Contractual Clauses.
• Cloudflare, Inc. (Email Service) — sends the platform’s e-mails, such as ticket confirmations. It is not located in the EU. Safeguard for transfers: Cloudflare’s data processing agreement (version 6.4) with the EU Standard Contractual Clauses (Module Two), and a transfer impact assessment made on 3 September 2026.
• Google Cloud EMEA Limited (Google Cloud Storage) — keeps the daily backup copy of the platform’s database, so it can be restored after a failure. The copy is stored in the EU, in Belgium (europe-west1), and each copy is deleted after 35 days. Any access by Google from outside the European Economic Area falls under the Google Cloud Data Processing Addendum, which includes the European Commission’s standard contractual clauses.
• Functional Software, Inc. (Sentry) — receives the platform’s error reports, so we can find and fix faults. An error report can contain technical details, the address of the page involved, an account identifier and an IP address. The reports are stored in Sentry’s EU region, in Germany. Any access by Sentry from the United States falls under Sentry’s data processing addendum, including the European Commission’s standard contractual clauses.

Not a sub-processor: Stripe

Payments for an organiser’s events are processed by Stripe on the organiser’s own Stripe account, under the organiser’s own agreement with Stripe. Stripe is the organiser’s payment provider and an independent controller for its own legal obligations, not our sub-processor. The contracting Stripe company in the European Economic Area is Stripe Payments Europe, Limited. For data that reaches Stripe, LLC in the United States, Stripe’s data processing agreement and transfer addendum (18 November 2025) rely on the EU-US Data Privacy Framework and, as a fallback, on the European Commission’s standard contractual clauses.

Who we are

Pilarres EOOD, UIC 208702712, Legis Center, office 3-8B, 152 6-ti Septemvri Street, 4000 Plovdiv, Bulgaria. E-mail info@bicyr.com.