Puntjes

Where your data is processed

The EU Data Act asks a cloud provider to say which country's law its infrastructure answers to, and what it does about an authority outside the European Union asking for data. This page is that statement, and the terms of service point at it.

Which country the infrastructure answers to

Puntjes runs on infrastructure in Germany, in the region Frankfurt, so the law of that country applies to it.

What we do about access from outside the EU

  • We have no company or branch outside the European Union, so no authority outside it can reach your data through another part of us.
  • Our servers, database, error reports and mail run in Frankfurt, but four suppliers there are American companies or have an American company in the contract: Laravel Cloud and Laravel Nightwatch, which run the application and collect its error reports; Neon, which holds the database; and Mailgun, which sends the mail. Five more are based outside the European Union: Apple Wallet and Google Wallet, which your customers use for their cards; GitHub, which receives the support requests you send us; Google Maps Platform, which turns your addresses into map coordinates; and Sentry, an American company that keeps the error reports from your browser in Frankfurt. The list below says what reaches each of them and what makes that lawful.
  • We hand over nothing without a legally binding order that applies to us. We check whether it really does, and we refuse or fight an order that is too wide or that clashes with European law.
  • If we ever have to hand something over, we tell you first. If the law forbids us to warn you, we tell you as soon as we may.

Who else processes your data

Running Puntjes takes a handful of other companies: one to run the servers, one to hold the database, one to send the mail. Each of them sees a part of what you keep here. This is all of them, what each one gets and where each one runs.

  • Laravel Cloud

    What it gets
    Runs the application, its cache and its background work, so it can reach everything Puntjes holds for you.
    Where it runs:
    Germany, Frankfurt
    What makes sending data there lawful:
    The EU-US Data Privacy Framework, which the European Commission decided gives your data the same protection there as here.

  • Neon

    What it gets
    Holds the database. Every customer, card and point you keep lives there.
    Where it runs:
    Germany, Frankfurt
    What makes sending data there lawful:
    The EU-US Data Privacy Framework, which the European Commission decided gives your data the same protection there as here.

  • Laravel Nightwatch

    What it gets
    Collects the details of a request that went wrong, so we can fix it. An email address can end up in one of those.
    Where it runs:
    Germany, Frankfurt
    What makes sending data there lawful:
    The EU-US Data Privacy Framework, which the European Commission decided gives your data the same protection there as here.

  • Sentry

    What it gets
    Receives a report when a page goes wrong in the browser, and how long pages take to load: the error, the page address without the part after the question mark, and the type of browser. A report can show what was on the page, such as a customer's name.
    Where it runs:
    Germany, Frankfurt
    What makes sending data there lawful:
    The EU-US Data Privacy Framework, which the European Commission decided gives your data the same protection there as here.

  • Mailgun

    What it gets
    Sends the mail that leaves Puntjes, so it sees who it goes to and what it says.
    Where it runs:
    Germany, Frankfurt
    What makes sending data there lawful:
    The EU-US Data Privacy Framework, which the European Commission decided gives your data the same protection there as here.

  • Mollie

    What it gets
    Takes your subscription payment and issues your invoice, so it sees your business name, your invoice address, your VAT number and your contact email address.
    Where it runs:
    Netherlands

  • Google Maps Platform

    What it gets
    Turns the address of your shop and your branches into map coordinates.
    Where it runs:
    United States
    What makes sending data there lawful:
    The EU-US Data Privacy Framework, which the European Commission decided gives your data the same protection there as here.

  • Apple

    What it gets
    Builds the card your customer keeps in Apple Wallet and pushes an update to their phone.
    Where it runs:
    United States
    What makes sending data there lawful:
    The standard contractual clauses the European Commission wrote for data that leaves the European Economic Area. They bind that company.

  • Google Wallet

    What it gets
    Builds the card your customer keeps in Google Wallet.
    Where it runs:
    United States
    What makes sending data there lawful:
    The EU-US Data Privacy Framework, which the European Commission decided gives your data the same protection there as here.

  • GitHub

    What it gets
    Receives a support request you send us: the subject and the text you typed, the name of your business, your plan and the state of your subscription, and the page you were on.
    Where it runs:
    United States
    What makes sending data there lawful:
    The EU-US Data Privacy Framework, which the European Commission decided gives your data the same protection there as here.

We tell you at least 30 days before we add a party to this list or swap one out, and you can tell us you object. If you do and we cannot resolve it, you can end the agreement before the change takes effect.

The rest of the picture

Which suppliers handle your data, and what they may do with it, is in the data processing agreement. What we do with the data of the people using Puntjes is on the page about your data.

Data processing agreementHow we handle your data