Voziko Sub-processor List
Last updated: 2026-11-07
This page lists the sub-processors that Voziko (a service of Polemarhi d.o.o., Vojvode Mišića 46/1, 35250 Paraćin, Serbia, PIB 112505565; [email protected]) engages to run the platform. The contract status column shows what has been confirmed for each one, as checked 2026-11-06. "Not confirmed" means we have not verified that a data processing agreement applies.
For every sub-processor we state: its purpose, the data it receives, its region, its contract status, and whether the user's browser contacts it directly (which exposes the user's IP address to it).
The transfer mechanism is the one the provider states in its own documents, checked 2026-11-06. This does not confirm that the assessment under the Serbian Personal Data Protection Act is complete. Where the contract status is not confirmed, this also does not confirm that the mechanism applies to our processing.
Sub-processors
| Sub-processor | Purpose | Data received | Region | Transfer mechanism | Contract status | Browser contacts directly? |
|---|---|---|---|---|---|---|
| Supabase | Database, accounts, real-time updates | Account/login and platform data | EU (Frankfurt, Germany) | EU SCCs (per the provider's documents) | Not confirmed. Provider publishes a DPA; our acceptance is not confirmed | Yes — for admin/driver sign-in and real-time driver updates |
| Railway | Application hosting (runs each request) | Request data in transit; logs may include IP | EU (Amsterdam, Netherlands) | EU-US DPF or EU SCCs (per the provider's documents) | Not confirmed. Provider publishes a DPA; our acceptance is not confirmed | No |
| Cloudflare | Domain, security (anti-abuse), content delivery, and encrypted database backup storage (R2) | All requests and IP addresses; encrypted database backups | Global edge network; R2 storage region not confirmed | EU-US DPF or EU SCCs (per the provider's documents) | DPA incorporated in the provider's terms | Yes — the browser connects to the nearest edge |
| GitHub Actions | Scheduled operations: the encrypted database-backup job and the data-retention job | Full database contents (the backup job produces a plaintext dump before encrypting it, and runs with production credentials) | GitHub does not publish a server region | EU-US DPF or EU SCCs (per the provider's documents) | DPA incorporated in the provider's terms; Actions not named, covered by its default for all Online Services | No |
| Brevo | Transactional and support/sales email: password resets, contact/lead form, feedback, go-live notifications, safety-report emails to the company's admins | Recipient email address and any details submitted in those forms; for a safety report its category, note and the ride's last chat messages (the booking's rider name and phone are never sent; phone numbers and email addresses typed into a note or message are removed) | EU (France) | Not established: provider's DPA not reviewed; access from the US and India is an open question | Not confirmed. Provider's DPA not reviewed | No |
| Geoapify | Geocoding (address ↔ location) | Search text and/or coordinates | EU (operator Keptago Ltd, Cyprus) | EU hosting, as stated by the provider; standard terms, no signed DPA | No signed DPA; provider's standard terms | No — request made by our server |
| OpenFreeMap | Map tiles | The map area viewed (tile coordinates); not IP | EU operator (Hyperknot Software Kft., Hungary); server location not published | EU operator; server location not published; no DPA | No DPA; processor role not settled | No — tiles fetched by our server (IP not sent) |
| Browser push services (Google/Mozilla/Apple/Microsoft) | Deliver ride notifications to drivers | The push subscription (endpoint + keys); the message payload is end-to-end encrypted and may include a ride's pickup address | Operated by the driver's browser vendor on globally distributed infrastructure; no per-subscription region is published or guaranteed | Google: EU-US DPF or EU SCCs; Apple: SCCs; Mozilla and Microsoft: not established | Not confirmed for any of the four; Apple's role is open | Yes — the driver's browser registers with its own push service |
| Google Firebase Cloud Messaging | Push alerts in the Voziko app. Active from the app release; no tokens stored before | Device token, platform type, new-ride text with no address | Global service | EU-US DPF or EU SCCs (per the provider's documents) | Not confirmed. The Firebase terms do not name FCM | App, not browser |
| Apple Push Notification service | Push alerts in the Voziko app. Active from the app release; no tokens stored before | Device token, platform type, new-ride text with no address | Not published | SCCs, per Apple's privacy policy | Not confirmed. Apple's developer terms have no processor wording; Apple's role is open | App, not browser |
Map data © OpenStreetMap contributors.
Changes to this list
We may add or replace sub-processors as the service evolves. The "last updated" date above shows the current version.
Questions
Contact Voziko at [email protected]. This list forms part of our Privacy Policy.