This is an English translation provided for information. The binding version is the Hungarian original (https://crewory.app/jog/alvallalkozok); in case of any discrepancy, the Hungarian text prevails.
Provider: Pagency Solution Kft. (4517 Gégény, Petőfi Sándor utca 47., Hungary) · Product: Crewory — https://crewory.app Effective: 21 October 2026 · Version: 2.0 Contact: hello@pagency.hu · +36 20 979 2801 · postal address: the Provider's registered office
1. What this list is for
In this list (consistent with Terms 1.3):
- Provider — Pagency Solution Kft., the operator of Crewory ("we");
- Partner — the agency or digital service provider that subscribes to Crewory and also resells it to its own clients;
- Client and Client Space — the Partner's client, and the separate workspace opened for the Client;
- User — anyone who logs in with their own account; Data Subject — anyone whose personal data the system processes.
Two kinds of data move in the system:
- The Partner's and the Users' own data (account, login, billing, the partner relationship) — for these the Provider is the controller; see the privacy notice.
- What is entered into the workspaces (clients, leads, bookings, emails, newsletter recipients, notes, attachments) — here the workspace owner (the Partner, or in a Client Space the Client) is the controller, and the Provider is a processor, or in Client Spaces the Partner's further processor. The data processing agreement (DPA) covers this.
Under GDPR Art. 28(2) the Provider may engage a further processor — informally: a subprocessor — only with prior authorisation. By accepting the DPA the Partner gives general authorisation for the providers on the list below (for Client Spaces on the basis of the authorisation received from its Client), on condition that we give advance notice of every change and the Partner has a right to object (section 6).
2. Where the data is
Crewory's database and uploaded files are on one server, Contabo's, physically in Lauterbourg, France — i.e. within the European Union. Daily backups are encrypted with AES-256; database backups are kept for 14 days and file backups for 35 days, so deleted data drops out of the backups within 35 days at the latest. We also keep a copy of the encrypted backups with a storage provider independent of the server, within the EU.
Apart from the hosting provider — on which the whole system technically runs — none of the providers below receives the database: each sees only what we pass to it for its own function (the text of an email, the content of an AI request, an encrypted backup file).
3. Subprocessors
The "Data layer" column shows whether the provider sees Layer 1 (own data), Layer 2 (data entered into the workspaces), or both.
| Provider | What we use it for | What data it sees | Data layer | Registered office / where data is processed | Third country? | Transfer basis |
|---|---|---|---|---|---|---|
| Contabo GmbH | Server and hosting: running the system, database, uploaded files, local copy of backups | Technically all stored data (the provider does not look at content, it only provides the machine and storage) | both | Registered office: Aschauer Straße 32a, 81549 Munich, Germany. Place of processing: Lauterbourg, France | No — EU | Not required: no transfer to a third country. Data processing agreement under the provider's terms |
| EU-based storage provider — selection in progress | Off-server copy of the encrypted backups | Only encrypted backup files — the encryption key stays with us; the provider cannot see the content | both (encrypted) | EU | No — EU | Not required: no transfer to a third country |
| Anthropic — Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland | The language model behind the "AI admin", the brief bot, the support assistant and text generation (default) | Only what we pass for a given request: the conversation text and summary, the company profile and company memory, a structural description of the system (objects, fields, automations — not the records), and — if the admin prepares a record operation — the record fields needed for the search | both (workspace data only if the User provides it in the request or asks for a record operation) | Processing on the provider's infrastructure, primarily in the USA | Yes — USA | European Commission standard contractual clauses (SCC, (EU) 2021/914), as part of the provider's data processing agreement; submitted content stays with the provider for at most 30 days and is not used for model training |
| OpenAI — OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland | Optional language model for the same functions; voice use (speech to text, text to speech) | As above, if an OpenAI model is chosen in the workspace; for voice use, the recorded audio and the text to be read aloud (we do not keep the audio) | both (as above) | Processing on the provider's infrastructure, primarily in the USA | Yes — USA | SCC ((EU) 2021/914), as part of the provider's data processing agreement; provider retention of at most 30 days, without model training |
| Sybell Informatika Kft. | Sending system emails from its own mail server (invitation, password, confirmation, booking confirmation, notifications); DNS for domains | Recipient email address, sender name, subject and body | both | Registered office: 1138 Budapest, Tomori utca 34. 2nd floor, Hungary; Cg. 01-09-293034; tax number 25859502-2-41. Place of processing: Hungary | No — EU | Not required: no transfer to a third country |
| bulk email provider with an EU data centre — selection in progress | Newsletters and automation emails, email from the workspace's own domain, delivery feedback (bounces, spam complaints) | Recipient email address, sender, subject and body; delivery events | both | EU data centre | No — EU | Not required: processing within the EU; if the selected provider allows access from outside the EU, the safeguard will be recorded here at selection |
Note on AI calls. When a User talks to the AI admin, the request and the context needed for the reply go to the model provider. If the User enters client data into the conversation, or requests a record operation for which the system retrieves records, the content of those records is transferred to the USA. We never send the full database, only the part belonging to the request.
4. Not subprocessors — independent controllers, or only our own data
These parties do not process data entered into the workspaces and are therefore not covered by the authorisation under the DPA; we list them here for transparency. Section 7 of the privacy notice applies to them.
| Party | Role | What it sees |
|---|---|---|
| Stripe — Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland (EU) | Card payments, subscription management. For payment data an independent controller: it handles card data under its own rules and card scheme requirements | The Partner contact's name, email address, billing details, card and transaction data. Card data never reaches Crewory. |
| Billingo Technologies Zrt. — 1133 Budapest, Árbóc utca 6., Hungary; Cg. 01-10-140802; tax number 27926309-2-41 | Invoicing and mandatory reporting of invoices to the Hungarian tax authority's Online Invoice system — the Provider's processor in Layer 1 | Billing name, address, tax number, invoice items and amount |
| NAV (Hungarian National Tax and Customs Administration) | Invoice data reporting is a legal obligation; independent controller | The mandatory content of issued invoices under the VAT Act |
5. "AI marketer" — only if the workspace owner links it
The AI marketer (aimarketinges.app) is also a product of the Provider, but a separate system from Crewory. By default no data is shared between them. It comes into play only if the workspace owner expressly links the two systems with a pairing key; the link can be removed at any time.
| Shared | NOT shared |
|---|---|
| Company profile (company name, activity, survey answers, company profile notes) | Client and lead records |
| List of services and opening hours | Email addresses, phone numbers, addresses |
| Titles and URLs of published websites, brand settings | Details of jobs, tasks, bookings |
| Aggregate, non-personal statistics and record counts per object | Record notes, attachments |
| The company's memory (general knowledge learned about the company), according to the chosen sharing level; notification of incoming leads | Anything pointing to an individual person |
The Provider acts on both sides of the link, and both systems run on the same EU server. Data protection classification of the link: both systems are products of the same Provider, so linking them does not constitute a transfer to another controller; for the data entered into the workspaces, the Provider acts as processor in both systems.
6. When a new subprocessor joins or the list changes
6.1 How we notify you
- This page is the official source, with date and version number: https://crewory.app/legal/subprocessors (Hungarian original: https://crewory.app/jog/alvallalkozok).
- At least 15 days before engaging a new subprocessor, replacing an existing one, or naming a provider under selection, we send a notice (consistent with DPA 9.3 and Terms 16.4): by email to the address in the Partner's account, and on the Crewory interface. The Partner informs its Clients (DPA 5.3).
- The notice states the new provider's name, what we use it for, what data it sees, where it processes data, whether it is in a third country, and the legal basis for the transfer.
6.2 How to object
- Within 15 days of the notice, you may object in writing, with reasons — in your own name or forwarding your Client's objection — to engaging the new subprocessor (DPA 9.4). Send objections to: hello@pagency.hu.
- We examine the objection and consult in good faith; where possible, we look for another solution.
- If consultation does not lead to a result within 15 days, the Partner may terminate the contract with effect from the date of the change, free of charge, by extraordinary termination; we refund pro rata the fees paid for time not used.
6.3 What we commit to for every subprocessor
- We impose in writing the same data protection obligations that bind the Provider (GDPR Art. 28(4)); if a subprocessor fails to perform, the Provider remains fully liable.
- We transfer data to a provider in a third country only with a valid legal basis (adequacy decision or the Commission's standard contractual clauses), and adapt to changes in the legal environment.
7. Questions, complaints
Contact us with data protection questions or objections: hello@pagency.hu, or Pagency Solution Kft., 4517 Gégény, Petőfi Sándor utca 47., Hungary. You may also complain to the Hungarian National Authority for Data Protection and Freedom of Information (1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; phone: +36 (1) 391-1400; email: ugyfelszolgalat@naih.hu; www.naih.hu), or to the regional court of your place of residence or stay.