GDPR sub-processors

Who processes your data.

Under GDPR Article 28, this is the complete list of our sub-processors. Any changes are announced to agency customers by email 30 days in advance.

Compliant with GDPR Article 28
Business data hosted in the EU

Up-to-date list · 9 September 2026

14 identified sub-processors

This page brings together the purpose, location and safeguards stated by each provider. Kopro’s contractual documentation is supplied on request; it is not presented as downloadable until that process is available.

Meta Platforms Ireland Ltd.

Measuring the effectiveness of our advertising campaigns on Facebook and Instagram (Meta Pixel). Used only on the marketing website, and only after explicit acceptance of the ‘Advertising’ category in the consent banner.

Data processed: Browser identifier (_fbp / _fbc cookies), IP address, pages viewed and conversion events (demo requests and newsletter sign-ups). No co-ownership business data.
Location: Ireland, with transfers to the United States governed by the Data Privacy Framework and Standard Contractual Clauses.
Legal basis: Explicit consent of the data subject (GDPR Article 6(1)(a))

Google Ireland Ltd. (Google Ads)

Measuring conversions from our adverts on Google Search. Used only on the marketing website, and only after explicit acceptance of the ‘Advertising’ category.

Data processed: Browser identifier (_gcl_au cookie), anonymised IP address, landing page and conversion events. Advertising personalisation is disabled.
Location: Ireland, with transfers to the United States governed by the Data Privacy Framework and Standard Contractual Clauses.
Legal basis: Explicit consent of the data subject (GDPR Article 6(1)(a))

Supabase Inc.

Database hosting, file storage and authentication.

Data processed: All business data (buildings, units, transactions, documents and user profiles).
Location: AWS Ireland, European Union (eu-west-1)
Legal basis: Performance of the service contract (GDPR Article 6(1)(b))

Vercel Inc.

Hosting the web application and marketing website; content delivery network (CDN).

Data processed: Technical logs (IP address and user agent); no persisted business data.
Location: Europe (Frankfurt region)
Legal basis: Performance of the service contract

Stripe Inc.

Online payment processing (cards, SEPA and Apple Pay).

Data processed: Payment data (tokenised card), email address, amount and invoice reference.
Location: EU (Ireland): payment data is tokenised and processed by a PCI-DSS Level 1 certified provider.
Legal basis: Performance of the service contract

GoCardless SAS

Optional SEPA Direct Debit collection of rent and rental charges for professionals who activate the service.

Data processed: Payer identity and contact details, bank details entered directly with GoCardless, SEPA mandate, amount, due date and payment status.
Location: France and the European Economic Area; any onward transfers are governed by the safeguards described by GoCardless.
Legal basis: Performance of the SEPA mandate and tenancy agreement; explicit activation by the professional and payer consent

Bridge SAS (Powens)

Open Banking: PSD2 bank aggregation for co-ownership managers.

Data processed: Bank credentials (never stored by us) and transaction history of the linked account.
Location: France
Legal basis: User consent (GDPR Article 6(1)(a)) and PSD2

Resend Inc.

Sending transactional emails (confirmations, notifications and general meeting notices).

Data processed: Recipient email address, email content and delivery status.
Location: EU (Germany)
Legal basis: Legitimate interests (GDPR Article 6(1)(f))

Google Ireland Limited (Gemini API)

Kapi AI assistant: primary provider of answers to residents’ and visitors’ questions.

Data processed: Question asked and building context sent to the assistant.
Location: Ireland (EU) for the contract; processing may take place outside the EU, governed by Standard Contractual Clauses (GDPR Article 46).
Legal basis: Legitimate interests; the feature can be disabled in the building settings

Groq, Inc.

Kapi AI assistant: fallback provider if Google is unavailable.

Data processed: Question asked and building context sent to the assistant.
Location: United States: Standard Contractual Clauses (GDPR Article 46).
Legal basis: Legitimate interests; the feature can be disabled in the building settings

Anthropic PBC

Kapi AI assistant: second fallback provider.

Data processed: Question asked and building context sent to the assistant.
Location: United States: Standard Contractual Clauses (GDPR Article 46).
Legal basis: Legitimate interests; the feature can be disabled in the building settings

Pennylane SAS

Accounting export (at the co-ownership manager’s explicit request).

Data processed: Accounting entries exported at the user’s request.
Location: France
Legal basis: Explicit consent through activation of the integration

Honeycomb (Hound Technology, Inc.)

Marketing website performance tracing (OpenTelemetry): loading times and slow network calls. Loaded only after acceptance of the ‘Audience measurement’ category.

Data processed: Technical browsing traces: page URLs, durations, network calls, user agent and request IP address. No co-ownership business data.
Location: United States: Standard Contractual Clauses (GDPR Article 46).
Legal basis: Explicit consent of the data subject (GDPR Article 6(1)(a))

Sentry (Functional Software, Inc.)

Application error monitoring for technical diagnostics.

Data processed: Stack traces, IP address and user agent. User data is masked by default (maskAllText, blockAllMedia).
Location: EU (Germany)
Legal basis: Legitimate interests (security and reliability)

Need GDPR documentation?

Write to our data protection contact to receive the available documents and specify the contractual clauses your organisation needs.

Contact our data protection contact Privacy Policy