To ensure GDPR compliance, I need clarification on four points:

Do you provide a signed Data Processing Agreement (DPA)?

Are you certified under the EU–US Data Privacy Framework or do you rely on Standard Contractual Clauses (SCCs) for data transfers outside the EU/Switzerland?

Where are your servers located and can you provide a list of all sub-processors?

Does ConveyThis send any data to external servers before user consent is given via a cookie banner/consent manager?

As the website operator, I am legally responsible under GDPR, so I must document these points clearly.