Banking and commerce
GDPR Pennylane
In an indie stack, Pennylane is used for Accounting and invoicing. Entity cited: Pennylane, a SAS registered with the RCS of Cherbourg under number 880 265 921, registered office 3 rue de Franche Comté, 50100 Cherbourg-en-Cotentin (general terms cited, version of 26 September 2023).. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 5, 2026. Verified on October 5, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Pennylane
Yes, within the meaning of the help: the processing agreement is annexed to the terms, with no additional document to sign. URL of a standalone PDF of that agreement: not disclosed.
Stated role
The help on the approved platform states that, depending on the processing, Pennylane acts as controller or as processor, and that a processing agreement is already included in the contract. The agreement governs the processor role. The full text of that agreement has not been reproduced here.
Personal data
Detailed categories read in a policy on 5 October 2026: not disclosed.
Sub-processors of Pennylane
Public list (stated last modification: 16 December 2025). It names in particular Amazon Web Services EMEA SARL (European Union, hosting), Outscale, S3NS, and Scalingo (France, approved platform), and Vercel (European Union, hosting and deployment). The full table is not copied here.
Transfers outside the EU
Hosting / location
The security page indicates AWS hosting in Ireland for platform data, and, for the approved platform (formerly PDP), 3DS Outscale in France (SecNumCloud). The help states that approved-platform data is in France at SecNumCloud hosts, and that the other platform data is in the European Union. The sub-processor list (stated modification: 16 December 2025) places Amazon Web Services EMEA SARL in the European Union, and Outscale, S3NS, and Scalingo in France for the approved platform.
EU–United States Data Privacy Framework
Pennylane is a French SAS. Data Privacy Framework registration read on 5 October 2026: not disclosed.
Cookies
Cookie names: not disclosed.
Typical use, written by StackLégal and not by the vendor: Accounting and invoicing.
History
Last update: October 5, 2026.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 5, 2026.
Frequently asked questions
Is Pennylane a processor within the meaning of the GDPR?
The help on the approved platform states that, depending on the processing, Pennylane acts as controller or as processor, and that a processing agreement is already included in the contract. The agreement governs the processor role. The full text of that agreement has not been reproduced here.
What DPA does Pennylane publish?
Yes, within the meaning of the help: the processing agreement is annexed to the terms, with no additional document to sign. URL of a standalone PDF of that agreement: not disclosed.
Which further sub-processors does Pennylane publish?
Public list (stated last modification: 16 December 2025). It names in particular Amazon Web Services EMEA SARL (European Union, hosting), Outscale, S3NS, and Scalingo (France, approved platform), and Vercel (European Union, hosting and deployment). The full table is not copied here. https://www.pennylane.com/fr/legal/subcontractors
Where does Pennylane state that it processes data, including outside the EU?
The security page indicates AWS hosting in Ireland for platform data, and, for the approved platform (formerly PDP), 3DS Outscale in France (SecNumCloud). The help states that approved-platform data is in France at SecNumCloud hosts, and that the other platform data is in the European Union. The sub-processor list (stated modification: 16 December 2025) places Amazon Web Services EMEA SARL in the European Union, and Outscale, S3NS, and Scalingo in France for the approved platform.
Is Pennylane registered under the EU–United States Data Privacy Framework?
Pennylane is a French SAS. Data Privacy Framework registration read on 5 October 2026: not disclosed.
Which personal data does Pennylane mention?
Detailed categories read in a policy on 5 October 2026: not disclosed.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.