General Information
This document contains information about third parties (subprocessors) that may process personal data of Whispet application Users on behalf of the Data Controller.
Data Controller: CRE8EVE Sp. z o.o. (KRS: 0000912669, NIP: 8513262229, Tulipanowa 4, 72-003 Dobra, Poland)
This document is made available in accordance with the requirements of Art. 28 GDPR regarding transparency in the further entrustment of data processing.
List of Subprocessors
1. Apple Vision framework (on-device — not a subprocessor within the meaning of Art. 28 GDPR)
The Apple Vision framework is a component of the iOS system operating exclusively on the User's device. The App uses this framework for smart pet photo detection (Smart Detection) only on photo thumbnails held in device memory. No image data or analysis results are transferred to Apple or any other external party. From a technical standpoint, Apple is not a subprocessor for this service within the meaning of Art. 28 GDPR — the mention in this document serves the purpose of full transparency.
2. Apple Inc. — App Store / In-App Purchase
| Parameter | Value |
|---|---|
| Entity | Apple Inc. |
| Registered office | One Apple Park Way, Cupertino, CA 95014, USA |
| Service | Apple In-App Purchase, App Store |
| Data scope | Transaction data (transaction ID, subscription status) |
| Purpose | Processing subscription payments (iOS/macOS) |
| Notes | The Controller does not have access to payment data (card numbers, bank details). Apple processes payments as an independent data controller. |
| Privacy policy | https://www.apple.com/legal/privacy/ |
3. Apple Inc. — iCloud / CloudKit
| Parameter | Value |
|---|---|
| Entity | Apple Inc. (USA) — for Users in the EEA, the iCloud services agreement is concluded with Apple Distribution International Ltd. (Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) |
| Registered office | One Apple Park Way, Cupertino, CA 95014, USA |
| Service | Apple iCloud / CloudKit (User's private database and sharing database) |
| Purpose of processing | Synchronization of User's data across devices within their iCloud account (pets, photos, entries, reminders, medical data) and Shared Care functionality (sharing selected pets with designated people) |
| Data categories | All User data created in the app (except UI cache and local settings): pet profiles, photos, event journals, medical data (vaccinations, medications, vet visits, allergens, food, documents), Shared Care data (invitations, Participants list) |
| Location | Apple data centers (EU and USA) |
| Transfer basis | Standard Contractual Clauses of the EU Commission — Apple is an officially certified entity |
| Security | Encryption at-rest (AES-256) and in-transit (TLS 1.3). User data in private iCloud database is encrypted with a key protected by the iCloud account. With iCloud Advanced Data Protection enabled, Apple declares it does NOT have access to user data content (end-to-end encryption). |
| Privacy policy | https://www.apple.com/legal/privacy/ |
| Data Processing Agreement | iCloud Terms of Service (part of User's Apple ID account terms) + Apple Developer Program License Agreement (DPA for apps) |
Note on Shared Care: The pet sharing feature ("Shared Care") operates exclusively through the Apple CloudKit sharing infrastructure. Each shared pet has its own isolated area within the Owner's iCloud database. All Shared Care data flows directly between participants' devices via Apple servers — the Controller does NOT mediate the transfer or have access to the shared content. The feature is not related to the Apple iCloud Family Sharing platform service.
4. Apple Inc. — APNS (Apple Push Notification Service)
| Parameter | Value |
|---|---|
| Entity | Apple Inc. (APNS — Apple Push Notification Service) |
| Registered office | One Apple Park Way, Cupertino, CA 95014, USA |
| Service | Apple Push Notification Service |
| Purpose of processing | Delivery of push notifications to User's devices (reminders for vaccinations/medications/visits, silent notifications about new changes in shared pets in Shared Care) |
| Data categories | Device token (push notification token) — assigned to User's Apple ID. Notification content (encrypted in transit). No access to other app data. |
| Location | Apple data centers (EU and USA) |
| Transfer basis | Standard Contractual Clauses of the EU Commission |
| Security | TLS 1.3, cryptographic tokens, notification payload encryption |
| Privacy policy | https://www.apple.com/legal/privacy/ |
| Data Processing Agreement | Apple Developer Program License Agreement |
4a. Apple Inc. — Apple Maps / MapKit (address suggestions and geocoding)
| Parameter | Value |
|---|---|
| Entity | Apple Inc. (Apple Maps / MapKit) |
| Registered office | One Apple Park Way, Cupertino, CA 95014, USA |
| Service | Apple Maps — search suggestions for places and addresses, determination of coordinates (geocoding), the map preview on the clinic card and launching navigation |
| Purpose of processing | Suggesting the clinic's name and address while the User types, and determining the clinic's coordinates (map pin, launching navigation) |
| Data categories | The text typed by the User into the clinic name or address field, and the address or coordinates of a saved clinic (map preview, navigation). No pet data, medical data, photos, or the User's contact data. No device location — the App does not request access to location |
| Location | Apple data centers (EU and USA) |
| Transfer basis | Standard Contractual Clauses of the EU Commission (Apple DPA) |
| Security | TLS; queries handled by Apple's system API (MapKit) |
| Legal basis (GDPR) | Art. 6(1)(b) — performance of a contract (App functionality) |
| User control | Queries are sent only when the clinic features are used: typing in the clinic form, opening a clinic card with the map preview, choosing "Navigate". The User may enter the address manually and not use the suggestions; no clinics added = no queries |
| Privacy policy | https://www.apple.com/legal/privacy/ |
Scope: the search region is derived from the country set in the system settings or from the address of a clinic previously added by the User — the App does not read the device's position.
Dictation: the App does not perform its own speech recognition and does not request access to the microphone (status as of 13 July 2026). Dictation of notes is performed by the microphone of the iOS system keyboard — an Apple feature in which the App receives only the finished text and never has access to the audio. The Apple Speech Recognition Service is not a subprocessor of the Controller.
Changes to the Subprocessors List
The Controller undertakes to update this document in the event of changes to subprocessors or the scope of data processing.
The User will be informed of significant changes through the Application.
Contact
For inquiries regarding data subprocessors:
E-mail: hello@whispet.app
Document generated for Whispet app v1.1