CrewShift Landing Page Subprocessor List
Last updated: 2026-10-12 Version: 2.4 Scope:crewshift-app.com and zmianowo-app.pl as landing pages only
1. Scope
This list covers providers that may process data in connection with the landing page, forms, security and optional analytics.
It does not cover the CrewShift/Zmianowo application, accounts, payments, application database, employee data or training modules. Those areas are governed by the application subprocessor list, which is also presented during registration.
2. Providers
| Provider | Role | Data categories | Use condition |
|---|---|---|---|
| Cloudflare Inc. | Workers hosting, server functions, infrastructure logs and metrics, request rate limiting and Turnstile | IP, headers, source domain, request and error logs, rate-limit key and metadata, verification token, device and browser signals | hosting, logs and rate limiting as page infrastructure; Turnstile on form submission |
| Resend / Plus Five Five, Inc. | e-mail delivery for forms and Brillnet-owned contact-list handling | full name, e-mail, company, subject, message content, assessment result, subscription source, consent or unsubscribe status, message metadata | when the user submits a form or subscribes to Brillnet-owned communication |
| Google Ireland Ltd. / Google LLC | Google Analytics 4 | cookie identifiers, page events, device data | only after analytics consent and when GA4 is configured |
3. Transfers outside the EEA
Technical and email providers may process specified data outside the EEA, including Resend / Plus Five Five, Inc. Transfers are qualified by recipient, data and purpose under GDPR Chapter V. We use the applicable adequacy decision, including DPF only for a covered recipient and scope, or Standard Contractual Clauses with the required assessment and supplementary measures. A DPA governs Article 28 duties; the transfer also requires an applicable Chapter V basis. Details of the basis and safeguards are available through this Policy’s contact.
4. Deliberately excluded items
The landing page should not list services that are not used by the page itself, in particular:
- payment processors,
- application login,
- the production application database,
- error monitoring, unless actually enabled in this project,
- providers of production-application features for training content, learner progress or tests.
If any of those services is actually added to the landing page, this list should be updated before deployment.