Sub-Processors & Data Partners
Last updated: 22 May 2026 Effective date: Launch
What is a sub-processor?
A sub-processor is a third-party service that processes personal data on our behalf as part of operating MontenegroHousing.com. Under GDPR Article 28 and Montenegro's Personal Data Protection Act (PDPL), we are required to maintain a transparent list of all sub-processors with access to user data.
Current sub-processors
| # | Service | Purpose | Data processed | Location |
|---|---|---|---|---|
| 1 | Railway | Application & database hosting | All user accounts, listings, cadastre verification cache | United States (US-West2 region) |
| 2 | Cloudflare | CDN, DDoS protection, DNS | IP addresses, request metadata, cached static assets | Global edge network |
| 3 | Cloudflare R2 | Encrypted daily database backups (22-day retention) | Full database snapshots (encrypted at rest) | EU / US storage regions |
| 4 | Cloudinary | Image hosting, optimization, CDN | Property listing photos, agent profile images | Global CDN |
| 5 | Resend | Transactional email delivery | Recipient email addresses, message content (verification, contact form, agent notifications) | EU + US infrastructure |
| 6 | Sentry | Application error monitoring | Stack traces, user agent strings, IP addresses (anonymized where possible) | EU region |
| 7 | Google Analytics 4 | Anonymous traffic analytics | Anonymized device + behavior data (no personally identifiable information) | Google global infrastructure |
| 8 | Cron-job.org | Scheduled task triggers (listing expiry, etc.) | No personal data — webhook URLs only | Germany |
Upstream data sources (not sub-processors)
The following services are data sources, not sub-processors. We query them but do not transmit user personal data to them:
- Geoportal Karadağ (geoportal.co.me) — Montenegro state cadastre WMS service. We query parcel IDs only; no user data is sent.
- eKatastar (katastar.uprava.gov.me) — Montenegro state cadastre detail service. Same as above; parcel ID queries only.
Data Processing Agreements
Each sub-processor has signed (or is covered by) a standard GDPR-compliant Data Processing Agreement with their respective customers:
- Railway DPA: railway.app/legal/dpa
- Cloudflare DPA: cloudflare.com/cloudflare-customer-dpa
- Cloudinary DPA: cloudinary.com/privacy
- Resend DPA: resend.com/legal/dpa
- Sentry DPA: sentry.io/legal/dpa
- Google Analytics DPA: business.safety.google/adsprocessorterms
Updates to this list
We will update this page whenever a sub-processor is added, removed, or significantly changed. Material changes are also announced to registered users via email at least 30 days in advance, in accordance with GDPR Article 28(2).
How to object
If you have concerns about any sub-processor, you may contact our Data Protection contact at contact@montenegrohousing.com. Under PDPL and GDPR Article 21, you have the right to object to specific processing activities.
Questions
For data protection inquiries, please contact: contact@montenegrohousing.com
For our general Privacy Policy, see Privacy Policy.
Disclaimer: This document is provided for informational purposes only and does not constitute legal advice. MN Housing is not a law firm. For legal advice, please consult a qualified attorney.