www.hookd.group
Document Set v1.2 · Effective: 2026-05-18
Supersedes: v1.1 (2026-05-18) and v1.0 (2026-05-15)
This document is part of the Hookd Group v1.2 legal pack, comprising: General Terms & Conditions, Privacy Policy, Cookie Policy, Refund Policy, Data Processing Agreement (DPA, Annex I to the Terms), and Subprocessor List. All documents in this set share the same effective date and must be read together. In the event of conflict between documents, the order of precedence is: (i) any individually-signed Order; (ii) the General Terms & Conditions; (iii) the Data Processing Agreement (for matters of personal-data protection, the DPA prevails over the Terms); (iv) the Refund Policy; (v) the Subprocessor List; (vi) the Privacy Policy; (vii) the Cookie Policy.
Hookd Group is the operating brand of OmnisMundi GmbH, a private limited company organised under the laws of the Federal Republic of Germany, with registered office at Kirchhainer Strasse 62, 60433 Frankfurt am Main, Germany, registered with the commercial register of the local court of Frankfurt am Main (Managing Director: Gerald Heydenreich). All references in this document to "Hookd Group", "the Company", "we", "us" or "our" mean OmnisMundi GmbH acting under the brand "Hookd Group". General contact: info@hookd.group. Data-protection enquiries: privacy@hookd.group. Web: https://www.hookd.group.
This Subprocessor List is referenced from Section 8 of the Hookd Group Data Processing Agreement (DPA) and from Section 6 of the Hookd Group Privacy Policy. It identifies the entities engaged by Hookd Group to process personal data on behalf of Hookd Group Clients (Controllers) in the course of providing the Hookd Group Service.
Subprocessor changes are notified to Controllers at least 14 days before they take effect. Controllers may object on reasonable data-protection grounds per DPA Section 8.4.
| Name | Role / Purpose | Location | Data Categories | Transfer Mechanism | Status |
|---|---|---|---|---|---|
| Polar Software, Inc. | Payment processor (Merchant of Record) — billing, recurring charges, refunds, invoicing | USA | Billing-contact name, business address, VAT ID, tokenised payment-card metadata, transaction history | SCCs Module 2 + DPF (where applicable) | Live |
| Brevo SAS | Transactional + marketing email delivery; integrated outbound email channel where Client activates email feature | France (EEA) | Sender + recipient email addresses, message content, open/click event timestamps and metadata | Intra-EEA (Art 44 GDPR not applicable) | Live |
| Anthropic, PBC | Premium-tier AI model (Claude Sonnet) for Cast content generation | USA | Input prompts containing AI-generation context (which may include Prospect names / business email / brief context), Hookd Group-side audit hashes | SCCs Module 3 + DPF | Live |
| Anthropic, PBC | Mid-tier AI model (Claude Haiku) for AI openers, deep enrichment, classification | USA | As above for the same provider | SCCs Module 3 + DPF | Live |
| PostHog Inc. | Product analytics, usage instrumentation, dashboards (per Phase 7 instrumentation spec) | USA | User identifiers (pseudonymised), event metadata (clicks, views, feature usage), session timestamps | SCCs Module 2 + DPF | Live |
| Hetzner | Application hosting, web server, database, file storage | Frankfurt, Germany | All Client Content at rest; encrypted | SCCs Module 3 + DPF | Live |
Polar operates as the Merchant of Record for all Hookd Group transactions, meaning Polar (not Hookd Group) is the entity that contracts directly with the Client for the payment transaction and handles tax, refunds, and chargeback flows. Card data is tokenised by Polar and not stored by Hookd Group.
Per the internal AI Model Routing Specification, Hookd Group uses a least-cost-with-quality-floor routing logic across multiple AI providers. The current stack comprises:
Provider rotation and tier transitions are governed by the routing logic and are not Controller-controlled. Where the Controller has a documented data-protection objection to a specific provider, Hookd Group will accommodate within reasonable engineering constraints.
DeepSeek is located in Hong Kong SAR / People's Republic of China, which does not benefit from a European Commission adequacy decision. Hookd Group maintains DeepSeek under elevated review pending completion of a Schrems II-style Transfer Impact Assessment ("TIA"):
A formal TIA will be completed before public launch; if the assessment is not favourable, DeepSeek will be replaced with an alternative budget-tier provider.
As of the version date of this List, the hosting and backup providers are: Hetzner (Frankfurt, Germany) for application hosting, web server, database and file storage (see table). The provider-selection preferences applied were:
Some subprocessors are engaged only when the Controller activates specific features:
Controllers who do not activate the email feature are not subject to data transfer to Brevo.
None as of the version date of this List. Removed or replaced subprocessors will be listed here with the effective date of removal and the reason.
Hookd Group may update this Subprocessor List from time to time. Material changes (additions, replacements, removals) will be communicated to Controllers at least 14 days before they take effect, per DPA Section 8.4.