Subprocessors
These are the providers that process personal data on our behalf. For a client authority, they are our subprocessors within the meaning of the data processing agreement.
| Provider | Role | Data | Location | Safeguards |
|---|---|---|---|---|
| Tizoo SA (AlpHosting) | Hosting of the website, database and photos; fallback email delivery | All application data | Switzerland | Swiss law, hosting contract |
| Meta Platforms Ireland Ltd. / Meta Platforms, Inc. | Delivery of WhatsApp messages (WhatsApp Business Platform, Cloud API) | WhatsApp number and profile name, message content, photos, shared location | Ireland, United States and other countries | WhatsApp Business data processing terms; Data Privacy Framework or standard contractual clauses |
| Resend (Plus Five Five, Inc.) | Delivery of service emails (verification, notifications, digest) | Email address, email content, delivery logs | United States (account data and logs); delivery possible from the EU | Data processing agreement (DPA); Data Privacy Framework or standard contractual clauses |
| Office fédéral de topographie swisstopo | Base maps (tiles) in Switzerland and geocoding of addresses (address → position, position → official address) | Tiles: browser IP address and area viewed. Geocoding: address or coordinates searched for, sent by our server (never the IP address, name or number) | Switzerland | Public service of the Swiss Confederation; FSDI terms of use (free, fair use) |
| OpenStreetMap Foundation | Fallback geocoding (Nominatim), outside Switzerland or during a swisstopo outage. No map tiles any more | Address or coordinates searched for, sent by our server | United Kingdom | Country recognised as adequate by Switzerland and the EU; the foundation's privacy policy |
| IGN, Géoplateforme (Base Adresse Nationale) | Geocoding of addresses with the Base Adresse Nationale, for a public authority located in France | Address or coordinates searched for, sent by our server | France | Public service of the French State, in the European Union; terms of use of the Géoplateforme |
| CARTO (CartoDB Inc.) | Base map for reports reserved for administrators | IP address of administrators' browsers | Depending on the provider's content delivery network | The provider's privacy policy |
| MapTiler AG | Option: base maps for an instance outside Switzerland, if a key is configured | Browser IP address and area viewed | Switzerland | Swiss law; the provider's privacy policy |
| Stadia Maps, Inc. | Option: base maps for an instance outside Switzerland, by default if MapTiler is not configured | Browser IP address and area viewed | United States | The provider's privacy policy; standard contractual clauses to be checked |
| Mailgun Technologies, Inc. (région UE) | Inbound e-mail: replies from services by e-mail and, where this channel is enabled, reports sent by e-mail | Sender address, message content and attachments | European Union (US company) | Data processing agreement (DPA); data in the EU region; Data Privacy Framework or standard contractual clauses for the parent company |
| Postmark (ActiveCampaign, LLC) | Option: receiving reports sent by e-mail, instead of Mailgun | Sender address, message content and attachments | United States | Data processing agreement (DPA); Data Privacy Framework or standard contractual clauses |
| Twilio Inc. | Option: receiving and sending SMS, where this channel is activated | Phone number and SMS content | United States | Data processing agreement (DPA); Data Privacy Framework or standard contractual clauses |
| ASPSMS (VADIAN.NET AG) | Option: receiving and sending SMS, as an alternative to Twilio | Phone number and SMS content | Switzerland | Swiss law; the provider's terms |
| Google (FCM), Mozilla, Apple, Microsoft | Delivery of notifications to your device, only if you turn them on | Device subscription address and encrypted message, unreadable by the service | United States and other countries | End-to-end encryption of the content (Web Push standard) |
| Sentry (Functional Software, Inc.), région UE | Option: collection of technical error reports, if this service is configured | Error message and page concerned, without personal data (e-mail addresses and numbers masked) | European Union | Data processing agreement (DPA); hosting in the EU |
Rows marked "Option" only apply when the corresponding service is configured on the platform or activated by a public authority for its instance. Today, on scopemy.city, base maps come from swisstopo and the e-mail and SMS channels are not activated.
The particular role of Meta
For the transmission of messages between residents and our business account, Meta acts as a processor. Meta also processes, as a separate controller, data relating to each person's WhatsApp account and their use of the app. These processing activities do not depend on us. That is why reporting on the web is always possible.
What we do not use
No third-party audience measurement tool (our own measurement sets no cookie and stays on our server), no advertising network, no fonts loaded from Google: our fonts are hosted on our own servers.
Changes
We update this list before any change of provider. Client authorities are informed in advance and may object under the data processing agreement.