Data processing

Last updated on 06/10/2026

This inventory provides an overview of technologies and service providers used across the Shipup and ZigZag platforms. It includes service infrastructure, business applications, software components, and historical entries.

Inclusion does not, by itself, mean that a provider acts as a sub-processor, receives personal data, or processes data relating to every customer. Applicability depends on the service, configuration, integrations, and features used. Software operated within our own infrastructure does not necessarily involve disclosure of personal data to the software vendor.

This inventory should not be read as a customer-specific list of personal-data recipients or as our formal record of processing activities. Entries marked “no longer used” describe historical use; that status alone does not confirm deletion of previously processed data.

Applicable subprocessor arrangements remain subject to the relevant data processing agreement, including any authorisation and notification requirements.

This list is not exhaustive. The sub-processors listed do not necessarily process personal data: some only handle technical or non-personal data. In addition, not all transactions use all sub-processors. This list may change from time to time, and we reserve the right to change suppliers if we need to do so for operational or commercial reasons.

Service name	Headquarters address	Data processing location	Processing activities concerned
Adyen	Amsterdam, Netherlands	EU (Netherlands)	Processing of payment data, including names. We do not access or store any payment card data.
Airbyte	San Francisco, California, USA	Airbyte Cloud (USA / EU) or self-hosted	Data transfer to analytics and AI agent tools, for reporting purposes.
Apple - Apple Pay	Cupertino, California, USA	USA	Processing of payment data, including names. We do not access or store any payment card data.
Apple - Apple Wallet	Cupertino, California, USA	USA	Sending mobile notifications.
AWS - Carrier email notifications	Seattle, Washington, USA	USA	Processing of emails sent by carriers, when carrier notification filtering is enabled.
AWS - Manual imports of tracking numbers and orders	Seattle, Washington, USA	USA	Manual import of tracking numbers and orders, performed exclusively by the support team.
AWS - S3	Seattle, Washington, USA	Depends on the S3 storage region	Storage of files containing customers' names, addresses, email addresses, phone numbers and order data.
AWS - Static files	Seattle, Washington, USA	USA	Hosting of the website and of images used to customize merchant branding.
Braintree	Chicago, Illinois, USA	USA	Processing of payment data, including names. We do not access or store any payment card data.
Carriers and logistics providers	Varies by carrier or provider	Country of origin of the carrier service	Consolidation of parcels returned by consumers for shipment to merchants. Customer contact details may be passed on to the carrier if a parcel cannot be delivered; as a rule, the address provided for a return is the merchant's warehouse address.
Chargebee	Walnut, California, USA	EU (Germany)	Billing.
Clay	New York, New York, USA	USA (AWS, US-East region)	Sales prospecting and customer relationship management.
CloudAMQP	Varberg, Sweden	EU (Belgium)	In-memory data storage.
Databricks	San Francisco, California, USA	Depends on the workspace cloud region	Reporting.
Datadog	New York, New York, USA	USA (Northern Virginia)	Platform observability and monitoring.
dbt	Philadelphia, Pennsylvania, USA	dbt Cloud (USA / EU) or run on our infrastructure	Reporting.
Elastic	Mountain View, California, USA	EU (Belgium)	Disk data storage.
Google Cloud Platform - BigQuery	Mountain View, California, USA	EU (Belgium)	Disk data storage.
Google Cloud Platform - Cloud SQL	Mountain View, California, USA	EU (Belgium)	Disk data storage.
Google Cloud Platform - Compute Engine	Mountain View, California, USA	EU (Belgium)	Underlying infrastructure for hosting and running the application.
Google Cloud Platform - Redis	Mountain View, California, USA	EU (Belgium)	In-memory data storage.
Google Cloud Platform - Vertex AI	Mountain View, California, USA	EU (Belgium)	Data prediction.
Google Maps	Mountain View, California, USA	USA / international (Google infrastructure)	Processing of addresses to display a map when required by the carrier service.
Google Pay	Mountain View, California, USA	USA / international (Google infrastructure)	Processing of payment data, including names. We do not access or store any payment card data.
Hoppscotch	USA (Hoppscotch Limited)	USA (cloud) or self-hosted	API testing.
HubSpot	Cambridge, Massachusetts, USA	USA	Customer relationship management (marketing, sales and customer service), including storage of customer data.
Infobip	Vodnjan, Croatia	EU (Germany)	Sending SMS notifications.
Lago	Paris, France	Lago Cloud (USA / EU)	Billing.
lemlist	Paris, France	EU	Sales prospecting: sending email campaigns and follow-up sequences to prospects.
LocationIQ	India (Unwired Labs)	USA or EU depending on the API endpoint used	Processing of location and address data.
Loqate	Chester, United Kingdom (GBG plc)	United Kingdom	Processing of address data.
Mailgun	San Antonio, Texas, USA	EU	Sending emails to merchants and consumers, including names, addresses, email addresses and purchase information. Storage of email addresses and, when consent is enabled, of recipient activity. The subject and body of sent emails are retained for 3 days.
Maxio	Atlanta, Georgia, USA	USA or EU depending on the hosting region	Billing.
Meta - WhatsApp	Menlo Park, California, USA	EU, USA, international	Sending mobile notifications.
Metabase	San Francisco, California, USA	Metabase Cloud (USA / EU) or self-hosted	Reporting.
Microsoft Azure	Redmond, Washington, USA	United Kingdom	Cloud platform on which the services are operated, including consumers' names, addresses, phone numbers, email addresses and order data.
Mixpanel	San Francisco, California, USA	EU (Netherlands)	Usage data analytics.
Modjo	Paris, France	EU (France)	Meeting recording.
n8n	Berlin, Germany	EU (Germany)	Workflow automation.
NReco PDF Generator	Kyiv, Ukraine	Runs on our infrastructure (Azure, United Kingdom)	Generation of PDF documents including customers' names, addresses and order data.
OpenStreetMap	Cambridge, United Kingdom (OpenStreetMap Foundation)	United Kingdom / EU	Processing of addresses to display a map when required by the carrier service.
PayPal	San Jose, California, USA	USA / international	Processing of payment data, including names. We do not access or store any payment card data.
Ringover	Paris, France	EU (France)	Telephone communication with customers.
Segment	San Francisco, California, USA	USA	Usage data analytics.
Shift4	Center Valley, Pennsylvania, USA	USA / EU depending on the contracting Shift4 entity	Processing of payment data, including names. We do not access or store any payment card data.
Shopify	Ottawa, Ontario, Canada	Canada / USA	Processing of returns data, when a Shopify integration is used.
Skalin	Paris, France	EU	Customer data storage.
Twilio SendGrid	San Francisco, California, USA	USA	Sending emails and SMS to merchants and consumers, including names, addresses, email addresses and purchase information. Storage of email addresses and, when consent is enabled, of recipient activity.
WorkOS	San Francisco, California, USA	USA	Single sign-on (SSO) authentication only.
Zendesk	San Francisco, California, USA	USA	Customer service software provider.

Data processing register

Last updated on 06/10/2026