List of processors
Version 1.1 · Effective from 30 October 2026 · Last changed 8 November 2026 · About 4 min read- Eolin runs on the services of three technical providers: Supabase, Vercel and Resend. Our e-mail, including the privacy@arwell.works address, is provided by Microsoft (Microsoft 365).
- We run the primary database in the EU (Ireland) and the app runs in the EU (Dublin, Ireland), right next to the database. All these providers are US companies or their subsidiaries, however, so in limited cases (e.g. during technical support) the data may be accessed from the USA; we cover this with the GDPR mechanisms set out in section 4.
- They may work with the data only on our instructions and only for running Eolin.
- If we change a processor, we will update this list in advance.
1. What a processor is
A processor is a company that processes personal data for us only on our instructions – for example, by running the server on which the database runs. We have concluded a data processing agreement under Article 28 GDPR with every processor. It obliges them to protect the data, not to use it for their own purposes and to delete or return it when the cooperation ends.
This list applies to Arwell Works s.r.o. as the operator of Eolin – both for the data it manages alone and for campaign data it manages jointly with the campaign organisers.
2. Technical providers
| Processor | Service | What data | Where it is stored |
|---|---|---|---|
| Supabase Pte. Ltd. (Singapore), part of the Supabase group (USA) | database, sign-in, file storage and scheduled jobs | all data listed in our data protection documents; short-term technical logs (may contain the IP address) | EU – Ireland (AWS eu-west-1) |
| Vercel Inc. (USA) | running the eolin.app website and the campaign app | data passing through requests; short-term technical logs (may contain the IP address) | EU – Dublin, Ireland (compute region dub1, next to the database in eu-west-1); website content is delivered through Vercel's worldwide network of servers |
| Plus Five Five, Inc., operator of the Resend service (USA) | sending e-mails: sign-in codes, the result of teacher verification, campaign reminders | e-mail address and e-mail content | EU – Ireland (AWS eu-west-1) |
| Microsoft Ireland Operations Limited (Ireland), a subsidiary of Microsoft Corporation (USA) | Microsoft 365: Arwell's e-mail, including the privacy@arwell.works address | e-mail address, name and the content of messages you send us or we send you | EU (Microsoft's EU Data Boundary) |
Further processors of these providers. The providers listed use their own subcontractors, in particular Amazon Web Services infrastructure in the EU regions listed (Microsoft: its own data centres). They publish their lists on their websites.
3. Campaign organisers as processors
For the manual verification of teachers, Arwell may authorise staff of the campaign organiser in the country concerned. For this purpose, the organiser acts as Arwell's processor under a data processing agreement:
| Processor | Purpose | What data |
|---|---|---|
| Club Alpbach Czechia & Slovakia, z. s., company ID (IČO) 218 86 369 (Czech Republic) | manual verification of teachers | first name, e-mail, domain, school, subjects |
4. Transfers outside the EU
All technical providers are US companies based in the USA or their subsidiaries (Microsoft Ireland Operations Limited belongs to the US Microsoft Corporation). We run the primary database in the EU (Ireland), the app runs in the EU (Dublin, Ireland) and e-mail is stored in the EU, but in limited cases the data may be accessed from the USA, for example during technical support or on the basis of US law. Such a transfer is protected by standard contractual clauses approved by the European Commission (Article 46 GDPR), which form part of the data processing agreements, and, for providers certified under the EU–US Data Privacy Framework, also by the Commission's adequacy decision (Article 45 GDPR). We will provide you with a copy of the relevant safeguards on request.
5. Who is not a processor
- Schools are not our processors. They put up the QR codes and verify the winners themselves when handing over prizes; their teachers see only aggregate results.
- Partners who donate prizes receive no personal data from us.
- Díky, že můžem, z. s., the co-organiser of Velvet Week 2026, receives only anonymous aggregate statistics.
- We do not use advertising networks or third-party analytics tools.
6. Changes
Before adding or replacing a processor, we will update this list. If a change meant storing data outside the EU, we will state it here in advance.