Subprocessors
List of subprocessors of Smarda GmbH pursuant to Annex 3 of the Data Processing Agreement (available at smarda.com/avv). Changes to this list are made in accordance with the procedure set out in Section 6 of the Data Processing Agreement (notice at least six weeks in advance, right to object).
As of: July 17, 2026
1 Core services (used for every contract)
| Subprocessor | Registered office | Service | Processing location | Transfer to a third country / safeguards |
|---|---|---|---|---|
| Google Cloud EMEA Ltd. (group: Google LLC, USA) | Dublin, Ireland | Cloud infrastructure: application hosting, managed databases, file storage, certificate and load balancing services, logging/monitoring, analytics infrastructure | Data centers in the EU (regions europe-west3 Frankfurt / europe-west4 Netherlands) | Support/remote access by Google LLC (USA) is possible; safeguard: EU Standard Contractual Clauses in the Google Cloud Data Processing Addendum, plus the EU-U.S. Data Privacy Framework (certified) |
| Twilio Inc. (SendGrid) | San Francisco, USA | Sending transactional emails (order, account, and system notifications) | EU (Email Data Residency: processing and storage in EU data centers) | Safeguard: EU Standard Contractual Clauses (Twilio DPA), plus the EU-U.S. Data Privacy Framework (certified) |
| Hetzner Online GmbH | Gunzenhausen, Germany | System/fallback email delivery (SMTP) | Germany/EU | No transfer to a third country |
2 Optional features (only when activated by the customer)
| Subprocessor | Registered office | Service | Processing location | Transfer to a third country / safeguards |
|---|---|---|---|---|
| DeepL SE | Cologne, Germany | Machine translation of store content | EU | No transfer to a third country |
| OpenAI Ireland Ltd. (group: OpenAI, L.L.C., USA) | Dublin, Ireland | AI-powered text/translation features, AI assistance | EU/USA | Safeguard: EU Standard Contractual Clauses (OpenAI DPA), plus the EU-U.S. Data Privacy Framework (certified); data is not used to train models |
| Anthropic Ireland, Limited (group: Anthropic, PBC, USA) | Dublin, Ireland | AI assistance features (support/usage assistant) | USA/EU | Safeguard: EU Standard Contractual Clauses (Anthropic DPA); data is not used to train models |
| Pinecone Systems, Inc. | New York, USA | Vector search index for assistance/help features | EU (Google Cloud, region europe-west4, Netherlands) | Safeguard: EU Standard Contractual Clauses (Pinecone DPA) |
| Openprovider (Hostnet B.V.) | Rotterdam, Netherlands | Domain registration on behalf of the customer | EU | No transfer to a third country; disclosure of registrant data to registries is required by domain registration regulations |
3 Notes
Payment service providers (e.g., Stripe, PayPal, Mollie, Klarna) process payment data as independent controllers and are not subprocessors of Smarda GmbH.
Services connected by the customer themselves — in particular shipping providers, newsletter services, their own SMTP servers, inventory management/ERP systems, marketplaces, other app/API integrations, and tracking and marketing services configured by the customer — are engaged by the customer under their own responsibility and are not subprocessors of Smarda GmbH.
4 Change log
July 20, 2024: Initial publication of the list.