Soma1. Scope matters
This page separates marketing infrastructure from customer processing. EUTS UG (haftungsbeschränkt) is the website controller. A supplier supporting that controller is not automatically a sub-processor for every customer. Contract status and permitted tasks must be confirmed in the processing agreement.
2. Marketing website infrastructure
| Provider | Purpose and data | Location and information |
|---|---|---|
| Hetzner Online GmbH | Static-site infrastructure; IP address, request information and necessary infrastructure security data. | Germany. Provider privacy notice. |
The marketing site has no analytics, ad networks, embedded media, registration form or payment processor. This hosting disclosure does not confirm that an executed Article 28 supplier agreement has been inspected. Correspondence uses EUTS communications infrastructure; the precise mailbox provider and retention must be confirmed for the channel used. The euts.ai notice describes its separate form and delivery providers.
3. Application identity provider — Google
A narrow Google sign-in option has been approved for the separate application, limited to openid email profile. Its purpose is identity verification and account association. It covers the Google account identifier, email and verification status, available basic profile details, and sign-in protocol/connection data. Google identity processing may involve the United States. No Gmail, Calendar, Drive, workspace-record, AI-inference or mail-delivery permission is included in this exception.
Google is an identity provider here, not automatically an Article 28 sub-processor for every SomaHQ customer. Before activation, record the applicable Google legal entity, actual controller/processor roles, service terms, access locations, retention and required Chapter V safeguards. See Google’s privacy policy and the application identity notice. This approved scope does not establish that production sign-in is active or that its contractual review is complete; business-data providers remain governed by the separate deployment schedule.
4. Customer deployment register
A product-provider list covering every SomaHQ deployment has not been verified. Before processing, EUTS must supply and obtain required authorisation for a register naming relevant hosting, storage, backup, support, email, AI and other processing suppliers. For each record the legal entity, task, data, locations including remote access, retention, contract and transfer safeguards. Include public search, geocoding and other outward services if personal data is sent.
A connected vendor may be the customer’s provider, an EUTS sub-processor or a separate controller according to its actual role; a connector label does not settle this. On-premises and self-hosted AI configurations still need an inventory of remote support and external access.
5. Authorisation and changes
The DPA requires equivalent duties and direct advance notice of additions or replacements under general authorisation, with an opportunity to object. Maintain the register and notice contact. Mentioning a provider here does not grant customer approval, and an emergency does not waive mandatory authorisation.
SomaHQ · EUTS UG (haftungsbeschränkt)
contact@euts.ai · Legal hub