Document
List of Subprocessors
Last updated: September 2026
To deliver our services, Storemate (“we”, “us”, “our”), operated by BUSZ sp. z o.o., engages third-party service providers (subprocessors) to process personal data on behalf of our customers.
All subprocessors are evaluated for their privacy, security, and confidentiality practices. Below is the current list of subprocessors used by Storemate.
Fakturownia Sp. z o.o.
- Purpose / processing activity
- Invoicing, accounting, and billing data management
- Location / data transfers
- Poland (EU)
- Safeguards / legal mechanism
- GDPR compliant, DPA in place
Stripe Payments Europe, Ltd. / Stripe, Inc.
- Purpose / processing activity
- Payment processing, subscription management, and fraud prevention
- Location / data transfers
- Ireland (EU), USA
- Safeguards / legal mechanism
- EU Standard Contractual Clauses (SCCs), DPF certified
Amazon Web Services EMEA SARL / Amazon Web Services, Inc.
- Purpose / processing activity
- Application hosting and infrastructure, file storage, content delivery (CloudFront) and TLS certificates
- Location / data transfers
- Germany (EU), Frankfurt region (eu-central-1); provider incorporated in Luxembourg and the USA
- Safeguards / legal mechanism
- Data hosted in the EU; EU Standard Contractual Clauses (SCCs), DPF certified
Anthropic PBC
- Purpose / processing activity
- Large language model (LLM) API provider for in-product features
- Location / data transfers
- USA
- Safeguards / legal mechanism
- EU Standard Contractual Clauses (SCCs) with transfer impact assessment
OpenAI
- Purpose / processing activity
- Large language model (LLM) API provider for fallback models and text embeddings
- Location / data transfers
- Ireland (EU), USA
- Safeguards / legal mechanism
- EU Standard Contractual Clauses (SCCs) with transfer impact assessment
Google
- Purpose / processing activity
- Large language model (LLM) API provider (Gemini) and Google APIs used for connected mailboxes
- Location / data transfers
- Ireland (EU), USA
- Safeguards / legal mechanism
- EU Standard Contractual Clauses (SCCs), DPF certified
Twilio
- Purpose / processing activity
- WhatsApp and messaging delivery for customer communication features
- Location / data transfers
- Ireland (EU), USA
- Safeguards / legal mechanism
- EU Standard Contractual Clauses (SCCs), DPF certified
Functional Software, Inc. (Sentry)
- Purpose / processing activity
- Application error monitoring and incident logging
- Location / data transfers
- Germany (EU), Frankfurt region; provider incorporated in the USA
- Safeguards / legal mechanism
- Data hosted in the EU; EU Standard Contractual Clauses (SCCs), DPF certified
Carriers chosen by the Customer
When a Customer connects a carrier in Storemate, the data needed to ship an order (the buyer’s name, delivery address, phone number, e-mail address and parcel details) is passed to that carrier. The carrier is a recipient chosen by the Customer, not our subprocessor: the data is disclosed on the Customer’s instruction, as set out in Section 2(6) of the Data Processing Agreement in Annex 1 to the Terms of Service. Each carrier processes the data under its own privacy policy.
InPost Sp. z o.o.
- Purpose / processing activity
- Parcel locker and courier delivery of orders to the Customer's buyers, including shipping labels and tracking notifications
- Location / data transfers
- Poland (EU)
- Legal role
- Recipient chosen by the Customer; data disclosed on the Customer's instruction
DPD (DPDgroup)
- Purpose / processing activity
- Courier delivery of orders to the Customer's buyers, including shipping labels and tracking notifications
- Location / data transfers
- EU, depending on the shipment route (e.g. Poland, Germany)
- Legal role
- Recipient chosen by the Customer; data disclosed on the Customer's instruction
DHL (DHL Group)
- Purpose / processing activity
- Courier delivery of orders to the Customer's buyers, including shipping labels and tracking notifications
- Location / data transfers
- EU, depending on the shipment route (e.g. Poland, Germany)
- Legal role
- Recipient chosen by the Customer; data disclosed on the Customer's instruction
Updates and changes
We may update this list from time to time as our infrastructure and services evolve. We will notify registered customers of any material change or addition to our subprocessor list with appropriate advance notice, providing the opportunity to object where applicable under the GDPR.
Questions about this list, or an objection to a subprocessor, can be sent to contact@storemate.io.