Sub-processors
This list forms an integral part of the Data Processing Agreement, which is Annex 1 to the Commercial Terms. It names the further processors the Operator has engaged in the processing carried out on the Customer's behalf, and is binding in the wording published at the given time.
Last updated: 2026-08-03
Engaging a new sub-processor
The Operator shall notify the Customer of an intended engagement of a new sub-processor at least 30 days in advance, following the procedure under article 18 of the Commercial Terms. The Customer may raise a reasoned objection on data protection grounds within 10 days of delivery of the notice. Failing agreement, and if the Operator insists on the engagement, the Customer may terminate the affected subscription without penalty and with a pro-rata refund of the price for the unused period.
Hostinger
Hostinger International Ltd
- Role
- Hosting
- Purpose
- Runs the application, the PostgreSQL database and the Redis cache — all live store data.
- Data location
- Frankfurt am Main, Germany (EU)
Cloudflare
Cloudflare, Inc. / Cloudflare Ireland Ltd
- Role
- Storage
- Purpose
- R2 object storage (uploaded store files and media, database backups), CDN, and custom store domains including TLS certificates. Also processes store visitors' IP addresses.
- Data location
- Global infrastructure with no jurisdictional restriction — the R2 bucket is not yet limited to the EU.
- Transfer safeguard:
- Standard contractual clauses (Art. 46(2)(c) GDPR) contained in the Cloudflare Data Processing Addendum.
Stripe
Stripe Payments Europe, Ltd.
- Role
- Payments
- Purpose
- Card payment processing and subscription management. The Platform stores no card numbers.
- Data location
- Ireland (EU), with onward transfer to Stripe, Inc. (USA)
- Transfer safeguard:
- Standard contractual clauses and EU–US Data Privacy Framework certification.
Google Workspace (SMTP)
Google Ireland Limited
- Role
- Purpose
- Delivery of transactional email (sign-in links, order notifications, billing messages).
- Data location
- Ireland (EU), with onward transfer to Google LLC (USA)
- Transfer safeguard:
- Standard contractual clauses and EU–US Data Privacy Framework certification.