Subprocessors

Last Updated: 3 Jun 2026 · Version 1.1

Kodwise OÜ uses carefully selected third-party service providers (“subprocessors”) to deliver its services. They process personal data only on our documented instructions under written Data Processing Agreements (DPAs) as required by Article 28 GDPR, and under confidentiality obligations. For transfers outside the EEA we rely on the EU Standard Contractual Clauses (SCCs) and, where a provider is certified, the EU–US Data Privacy Framework (DPF), together with supplementary measures and Transfer Impact Assessments.

1. CURRENT SUBPROCESSORS

No child personal data (name, age, date of birth) is sent to any advertising provider — only hashed parent/guardian identifiers and click identifiers. Advertising is directed at parents, not children. We do not sell personal data.

2. DATA TRANSFERS & SECURITY

All subprocessors are bound by written agreements that include confidentiality, security, data minimisation, and restricted-purpose clauses, and provide at least the level of data protection required under the GDPR. When a subprocessor operates outside the EEA, we rely on:
• the EU Standard Contractual Clauses (SCCs) (and the EU–US Data Privacy Framework where certified);
• additional technical and organisational safeguards (encryption, access controls, pseudonymisation, and — for AI — removal of direct identifiers before processing);
• Transfer Impact Assessments (TIAs) for third countries.

We make no transfers to a country without an EU adequacy decision.

3. DATA ACCESS LIMITATION

Subprocessors are granted only the minimum data necessary to perform their contracted duties. They are prohibited from using personal data for their own purposes, sharing it with additional third parties, or engaging further subprocessors without prior written authorisation from Kodwise OÜ.

4. SECURITY OBLIGATIONS

We review subprocessors for compliance with our data-protection standards. Each is required to:
• implement appropriate technical and organisational measures (GDPR Art. 32);
• notify us without undue delay of any actual or suspected data breach;
• support us in fulfilling data-subject requests and incident responses.

5. UPDATES TO THIS LIST

We may update this list as our services or subprocessors change. Material updates are published here with a revised “Last Updated” date, and we give prior notice of a new subprocessor as required under our DPA. Contact legal@kodwise.org to receive notifications or request the current list. Concerns may also be raised with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at https://www.aki.ee/en.

CONTACT

Kodwise OÜ
Ahtri tn 12, Kesklinna linnaosa, 15551 Tallinn, Harju maakond, Estonia
legal@kodwise.org · General: info@kodwise.org