Sub-processors
Lists the sub-processors ENA Innovation uses to provide the EnaFeedback service and the providers customers can optionally connect.
Effective date: · Last updated:
This English version is a translation provided for convenience. In case of conflict the Turkish version prevails.
This page lists the sub-processors that ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş. ("ENA Innovation") uses for personal data it processes on behalf of customer organizations when providing the EnaFeedback service. A sub-processor is a third-party service provider that processes data, which ENA Innovation processes as data processor, on ENA Innovation's behalf and on its instructions.
Each customer runs on its own dedicated application stack, database, cache and file storage. The providers below are used to operate these environments.
1. Standard sub-processors
These providers are used in the default EnaFeedback setup.
| Sub-processor | Service | Data categories | Location |
|---|---|---|---|
| Huawei Cloud | Hosting of customer environments and ENA Innovation's central infrastructure (ENA Cloud): virtual servers, managed PostgreSQL database, disk storage and backups | All data in the customer environment: feedback, attachments, hygiene ratings, tickets, staff and user records, survey responses, session data, audit records, backups; redirect logs (IP address, browser information) | Region stated in the customer agreement [Huawei Cloud region to be confirmed] |
| Cloudflare | DNS, reverse proxy, TLS and attack protection | All HTTP traffic in transit; visitor and user IP addresses, browser information | Global network (headquartered in the USA) |
| Logto | Authentication and invitations for administrator users | Administrator email address, phone, name, organization roles, session information | [Hosting model and region to be confirmed] |
| Resend | Email delivery (through ENA Innovation's notification infrastructure) | Recipient email address and message content (ticket status updates, staff codes, alerts) | USA |
| NetGSM | SMS delivery (through ENA Innovation's notification infrastructure) | Recipient phone number and message content | Türkiye |
| Google (Gemini) | AI features (through ENA Innovation's AI gateway): sentiment analysis, audio and video transcription, translation | Feedback text, audio and video attachments, page, survey and module text to be translated | [Region to be confirmed] |
| Sentry | Error monitoring (only if enabled in the deployment) | Error records and a sample of performance traces; authentication headers, cookies, password and token fields are removed before sending. Text and a screenshot written by the user through the "Report a bug" tool | [To be confirmed per deployment] |
Notes:
- Customers can switch AI features off. AI usage logs do not store prompts or content.
- ENA Innovation's notification infrastructure does not store email or SMS content or recipient details in its own logs.
- QR code, NFC and live display redirects, short links and the organization login redirect run through ENA Innovation's own central infrastructure (ENA Cloud). It runs on Huawei Cloud and logs the IP address, browser information, referring address, code and result for each redirect.
2. Providers customers can optionally connect
Customers can connect the following providers to EnaFeedback with their own accounts. In that case the contractual relationship is directly between the customer and the provider; ENA Innovation sends data, on the customer's instruction, only to the provider the customer chose. The location and terms of these providers depend on the customer's own account.
| Provider | Service | Data sent |
|---|---|---|
| SendGrid, the customer's own SMTP server or own Resend account | Recipient email address and message content | |
| NetGSM (own account), Twilio, Bird | SMS | Recipient phone number and message content |
| Firebase Cloud Messaging | Push notifications | Device push tokens, notification title and body |
| OpenAI, Anthropic, Google Gemini (with own key) | AI | Depending on the features enabled: feedback text, audio and video attachments, text to be translated |
| Webhook address set by the customer | Ticket routing and status change notifications | Event type, record IDs and status |
| YouTube, Vimeo | Video embeds added by the customer to content pages | The visitor's IP address and browser information when the embed loads |
3. Services that do not process personal data
| Service | Purpose | Note |
|---|---|---|
| GitHub Container Registry | Distribution of software releases | Software code only; no customer data |
| Nager.Date | Import of public holidays | Only a country code is sent |
4. Providers used for the website
ENA Innovation is the data controller for the www.enafeedback.com website. The providers used for it do not process customer data:
| Provider | Service | Location |
|---|---|---|
| Vercel | Website hosting; cookieless, aggregate visit and performance statistics | USA |
| Resend | Forwarding contact and demo form content to our team by email | USA |
| Cloudflare | Domain name (DNS) service | Global network (headquartered in the USA) |
[Whether website traffic passes through the Cloudflare proxy is to be confirmed.]
5. International transfers
Transfers to sub-processors located abroad are made under Article 9 of Turkish Law No. 6698 and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, relying on appropriate safeguards such as standard contracts. See the Privacy Policy for details.
6. Changes
At least 30 days before adding a new sub-processor or replacing an existing one, ENA Innovation updates this page and notifies its customers by email or within the Service. Customers may object in writing on reasonable grounds within 15 days of the notice. Details are set out in the Data Processing Agreement.
Questions: support@enainnovation.com