This is an English translation provided for convenience. The Romanian version is the legally binding text.
To operate, City Twin uses the categories of third-party providers below. In accordance with the GDPR (Art. 13(1)(e)), we publicly disclose the categories of recipients; the complete named list of sub-processors is made available to client institutions through the Data Processing Agreement (DPA), with a right to object to any change. The table shows the purpose of each category, what data it receives and where it is processed. We update it whenever there is a change.
Infrastructure and reasoning
| Provider category | Purpose | Data | Region of processing |
|---|---|---|---|
| Cloud hosting provider | Hosting the platform and storing data | Content served, technical logs (IP, requests); identifiable contact data sent through the contact and pilot forms (name, email, telephone, role, institution, county, message), only if you submit the form | Germany (EU) |
| CDN / protection provider | Protection and distribution (CDN, DNS, protection against attacks) | IP, HTTP requests, technical metadata | Global network, with points of presence in the EU; GDPR safeguards |
| European AI model provider | Generating answers | The question and the relevant information from the city model | European Union |
| Transactional email provider | Sending the platform's messages: sign-in, invitations, reports sent to a colleague, the city bulletin, form confirmations | The recipient's address and the content of the message | USA (GDPR safeguards) |
| Routing / accessibility service provider | Calculating isochrones / accessibility | Coordinates on the map | Germany (EU) |
Maps, traffic, environment
| Provider category | Purpose | Data | Region of processing |
|---|---|---|---|
| Commercial traffic data provider | The real-time traffic layer | Map tile requests | EU |
| Weather and air quality data services | Weather and air quality | Coordinates | EU |
| Community networks of environmental sensors | Air quality sensors | Coordinates / area | EU |
| Base map and geocoding providers (open projects) | Base map + place search | Tile / search requests | EU / UK |
| Satellite imagery provider | The “Satellite” view (optional) | Tile requests | USA (GDPR safeguards) |
| Terrain tile provider | 3D terrain (optional) | Tile requests | USA (GDPR safeguards) |
| Operators of public traffic cameras | Images from public cameras | Image request (local processing in the browser) | Romania (EU) |
Processing on our own infrastructure
Two processing activities do not involve any third-party provider, because they take place on infrastructure managed by ARSC, in the European Union:
| Processing | Purpose | Data | Region |
|---|---|---|---|
| Traffic measurement | Aggregated statistics on use of the website | The page visited, the referring source, the device type, without cookies, without persistent identifiers, without cross-site tracking | European Union |
| The contact and pilot forms | Receiving requests | Data provided voluntarily (name, email, telephone, role, institution, county, message) | Germany (EU) |
Transfers outside the EU/EEA
Hosting, data storage, AI reasoning and the main services (hosting, AI, routing, traffic, weather, sensors) are processed in the European Union. For the few categories in the USA (CDN/protection, transactional email, satellite imagery, terrain tiles) we rely on the safeguards provided by the GDPR (standard contractual clauses and/or adequacy decisions, as applicable). The data sent to these services for the operation of the map and the assistant is minimised (coordinates, tile requests, HTTP requests, the question and the relevant information from the city model). The email provider receives the recipient's address and the message, nothing more. We do not ourselves transmit data identifying the user; however, the IP address and other online identifiers resulting from the technical communication may be processed by providers and are treated as potential personal data. Communication between your browser and the server, including when forms are submitted, may pass through the security and distribution providers in the tables above.
Named list, objection and notifications
For client institutions, the complete named list of sub-processors (name, registered office, role) is provided within the contractual framework (annex to the DPA), and any change of sub-processor is communicated to the controller in advance, with a right to object, in accordance with the DPA. Supervisory authorities may request the list at any time. Questions: [email protected].