§Legal · Sub-processors

Every company that handles personal data for us, named.

Who they are, what they do for GPUBank, which data they receive, where, and the safeguard for each. Changes are announced 30 days before they apply.

Version 1.0 Effective 4 October 2026 GPU Compute OÜ · Tallinn ≈ 3 min read · 3 sections

The short version

Six sentences that say what the 3 sections below say. If the two ever disagree, the sections win.

Plain English

Six providers

Hosting, network, email, payment conversion, prices, and the GPU datacenters.

EU first

Your account data lives in France. Non-EU providers are covered by the standard clauses.

30 days of notice

A new provider is listed here and emailed to account owners before it starts.

Right to object

Business customers can object to a change under the DPA.

Nothing sold

No provider here may use your data for its own purposes, and none is an advertiser or a data broker.

Your sign-in choices

GitHub, Google and the wallet you pay from are your own choices, not our sub-processors.

Current sub-processors

What it means

This is the complete list. A provider that is not here does not receive personal data from us.

Provider	What it does for us	Personal data it receives	Location	Safeguard
Contabo GmbH	Dedicated servers for the website, the console, its database and backups.	Account, billing and support data	Germany (company) · datacenter in France, EU	EU processor, Art. 28 GDPR agreement
Cloudflare, Inc.	DNS, TLS termination, DDoS protection and the encrypted tunnel to our servers.	IP address and request metadata at the edge	United States · EU edge locations	Data Processing Addendum · EU-US Data Privacy Framework · SCCs
Namecheap, Inc. (Private Email)	Sends and stores the emails we exchange with you: codes, receipts, ticket replies.	Email address, message content	United States · mail servers in the EU and the US	Data Processing Addendum · SCCs
Payward, Inc. (Kraken)	Public market prices used to quote a top-up.	None (public data only)	United States	Not a processor: no personal data
GPU datacenter partners	Host the GPU servers your resources run on, one partner per region.	Your workload data in the region you chose. Not your account.	Paris, Frankfurt, Ashburn, Singapore	Art. 28 GDPR agreement · SCCs for Ashburn and Singapore

What it means

These are not our sub-processors: you decide to use them, and their own policies apply.

GitHub and Google, if you sign in with them. They act as independent controllers; we receive your id, name, email and avatar.
The wallet and the exchange you send coins from, before the payment reaches us.
Any external service your own workloads call from a GPU resource.

What it means

Thirty days of notice, here and by email, with the reason for the change.

Every addition or replacement is published on this page with its effective date at least 30 days ahead.
Account owners of business accounts receive the same notice by email.
To object, reply to that email or write to [email protected] before the effective date. The process is described in section 4 of the DPA.

Every version, dated. A change that matters is announced 30 days ahead.

4 Oct 2026List published: Contabo, Cloudflare, Namecheap Private Email, Kraken (public prices), GPU datacenter partners.

A question this page does not answer?

Write to [email protected]. Questions about our documents are answered within 15 business days, and anything about a running service much faster.

Data Processing Agreement Open console