Sous-traitants

This is an English translation. If it differs from the Spanish version, the Spanish version prevails.

What this page is for

It is the list of the providers that process personal data on CRUD's behalf to provide Coraula to its customers (sub-processors, in the language of Article 28 GDPR). The list each customer signs is in its Data Processing Agreement; this one is the current list.

Each new or replacement provider is notified by email to every customer at least 30 days in advance, and the customer may object on reasoned data protection grounds. Publishing the new list here does not replace that notice.

Providers

Arsys Internet, S.L.U.

Part of the IONOS group. Calle Madre de Dios 21, 26004 Logroño (Spain)

• What it does: Servers where the platform and the database run; storage of files and of the working copies of recordings; live class and recording servers. Also the destination of the backups CRUD undertakes to make.
• Products: All
• Where it processes data: Spain
• Safeguard: Processing within the European Economic Area

Cloudflare, Inc.

101 Townsend St., San Francisco, California (United States)

• What it does: R2 storage of the recordings that are played back, with the European jurisdiction chosen for the storage. Domain name system (DNS). Bot check (Turnstile) on the sign-in, contact and portal place-request forms: there it processes the signals on our behalf to stop bots and, in addition, on its own account, as a controller, to improve its detection.
• Products: Live (recordings); all (DNS and Turnstile)
• Where it processes data: Recordings: stored in the European Union; the requests to view them travel through its worldwide network. DNS and Turnstile: its worldwide network
• Safeguard: Its data processing agreement (version 6.4), incorporated into its self-serve subscription agreement. The EU-U.S. Data Privacy Framework, under which Cloudflare, Inc. is certified (checked on 5 November 2026), and, should it cease to apply, the European Commission's standard contractual clauses (module 3) that the agreement incorporates

Hostinger International Ltd.

61 Lordou Vironos, 6023 Larnaca (Cyprus)

• What it does: Sending the platform's emails, including those customers send to their students, and the mailbox where replies are received.
• Products: All
• Where it processes data: Hostinger does not publish where its email servers are. Its own providers include American companies
• Safeguard: Its data processing agreement, with the European Commission's standard contractual clauses for anything leaving the European Economic Area

Microsoft Ireland Operations Limited

Part of the Microsoft group. Dublin (Ireland)

• What it does: Machine translation of the text of the packages (Azure Translator).
• Products: Translate
• Where it processes data: European Union, through the service's European endpoint (France Central and West Europe regions)
• Safeguard: Microsoft's data protection addendum for its products and services. For processing by Microsoft Corporation in the United States, the EU-U.S. Data Privacy Framework, under which it is certified, and the European Commission's standard contractual clauses

OpenRouter, Inc.

United States

• What it does: Translating the text of images with an artificial intelligence model. OpenRouter passes each image on to the provider of the model we use.
• Products: Translate
• Where it processes data: United States and, depending on the model, its provider's country
• Safeguard: The European Commission's standard contractual clauses, according to OpenRouter's privacy policy

Google Cloud EMEA Limited

Part of the Google group. Dublin (Ireland)

• What it does: Only for customers who contract the long-term copy of recordings: storage of that copy.
• Products: Live, with that service contracted
• Where it processes data: European Union
• Safeguard: Processing within the European Economic Area, under the Google Cloud data processing addendum

What is not on this list, and why

• Each customer's payment gateway and Moodle: the customer contracts and decides on them.
• The IP location database: it is installed on our servers and does not send the IP to anyone.
• Static file delivery services (jsDelivr and cdnjs): they receive the IP address of people visiting some pages in order to serve styles and icons, but no customer data.
• The artificial intelligence tools we use to develop the platform: they work with fictitious data.