Rozuro Sub-processor List
Last updated: 19 May 2026
This page provides an up-to-date overview of the sub-processors that Atypisch uses to deliver Rozuro. This list supplements the Data Processing Agreement and the Privacy Statement.
The Dutch version of this list is binding. In case of conflict, the Dutch version prevails.
What is a sub-processor?
A sub-processor is a party that processes personal data on behalf of Atypisch for delivery of the Rozuro service. Atypisch has a written data processing agreement with each sub-processor, imposing privacy and security obligations at least equivalent to those between Atypisch and the Customer.
Current sub-processors
| # | Name | Function | Establishment | Data location | Transfer outside EEA |
|---|---|---|---|---|---|
| 1 | Nefos | Hosting, data storage, back-ups | Eindhoven, NL | Netherlands | No |
| 2 | Simezu | Authentication and payment processing | Eindhoven, NL (hosted at Nefos) | Netherlands | No |
| 3 | Mollie B.V. | Payment provider (via Simezu) | Amsterdam, NL | EEA | No |
| 4 | Stripe Payments Europe Ltd. | Payment provider (via Simezu) | Dublin, Ireland | EEA (with possible transfer to US under SCCs) | Possible, with appropriate safeguards |
| 5 | PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payment provider (via Simezu) | Luxembourg | EEA (with possible transfer to US under SCCs) | Possible, with appropriate safeguards |
Which data is processed by which sub-processor?
| Sub-processor | Categories of personal data |
|---|---|
| Nefos | All data entered into Rozuro or generated by Rozuro (account, invoices, customer data, logs) — stored on servers in the Netherlands |
| Simezu | Login data (email, hashed password), authentication tokens, subscription status, billing sessions, and payment intent metadata. Simezu acts as the identity and billing layer for Atypisch and routes payment-instrument data directly to the regulated payment provider (Mollie, Stripe, or PayPal). Atypisch itself never receives or stores card numbers, IBANs, or other raw payment-instrument data. Simezu is hosted on Nefos infrastructure in the Netherlands. |
| Mollie / Stripe / PayPal | Name, email, billing address, IP address, and payment-instrument data (card numbers, IBANs, SEPA mandates, etc.) necessary to process payments. These payment providers act as independent controllers for fraud prevention, KYC, and regulatory reporting under their own privacy policies. Atypisch receives back only a payment status, an opaque transaction reference, and the high-level data shown in the Privacy Statement section 3.2. |
Announcement of changes
Atypisch announces intended changes to the list of sub-processors at least 30 days before they take effect, by email to logged-in Customers or by notification in Rozuro.
Customers may object within 14 days on reasoned privacy grounds. If parties do not reach agreement, the Customer may terminate the Agreement with immediate effect pursuant to Article 6 of the DPA.
Change log
| Date | Change |
|---|---|
| 19 May 2026 | First publication. Sub-processors: Nefos, Simezu, Mollie, Stripe, PayPal. |
Contact
Atypisch Europalaan 2b, 3526 KS Utrecht, the Netherlands Email: info@atypisch.nl