Sub-processors

What this page is

When you connect a marketplace to Stockaroo, we process personal data on your behalf — your buyers' names, addresses and contact details, so that orders can be picked and labelled. Under UK GDPR you are the controller of that data and we are your processor.

A processor may only engage another processor with your authorisation. This page is that authorisation: it names every party we use, so you can see the whole chain rather than take our word for it. Engaging any of them for a new purpose, or adding a new one, follows the notice process in section 5.

For the data we hold aboutyou — your account, your billing — we are the controller. That is covered by the Privacy Policy, not this page.

Current sub-processors

netcup GmbH — hosting

Purpose

Runs the application and the databases. Everything Stockaroo stores lives here.

Data

All of it: your account, your inventory and orders, and your buyers' delivery details.

Location

Germany (European Economic Area)

Safeguard

None needed. The UK recognises the EEA as providing adequate protection, so no transfer mechanism applies. This is a deliberate choice — hosting in the EEA keeps your buyers' data out of scope of the transfer rules entirely.

Stripe — payments

Purpose

Takes your subscription payment and stores your card details.

Data

Your name, email, billing address and card details. Your buyers' data is never sent to Stripe.

Location

United Kingdom and United States

Safeguard

Stripe is certified under the UK Extension to the EU–US Data Privacy Framework, and separately applies the UK Addendum to the Standard Contractual Clauses.

Card details

Card numbers are entered directly into Stripe's own payment form and never reach Stockaroo's servers. We could not see your card number if we wanted to.

Resend — transactional email

Purpose

Sends sign-up verification codes, password resets and payment-failure notices.

Data

Your email address and the contents of those messages — a one-time code or a reset link. No buyer data and no order data is sent by email.

Location

United States

Safeguard

Standard Contractual Clauses with the UK Addendum, under Resend's data processing agreement.

What we deliberately do not use

It is worth being explicit about the absences, because they are the reason this list is short:

• No analytics provider. Not Google Analytics, not anything else. Nothing on Stockaroo reports your behaviour to a third party, which is also why the site sets no tracking cookies.
• No advertising or marketing trackers.
• No customer-support tool with access to your account. Support is email; we do not run a widget that can read your session.
• No AI or machine-learning service. Your inventory, orders and buyer data are not sent to any model provider, for training or for anything else.

Marketplace and carrier APIs — eBay, Amazon, Etsy, TikTok Shop, WooCommerce, Shopify, Royal Mail, DPD — are not sub-processors. You hold those accounts and you authorise us to act on them; data flows to and fromyour account with them, under your own agreement with each.

Where your data is

The application and every database sit in Germany, inside the EEA. Your buyers' personal data does not leave it.

The two transfers to the United States are Stripe (your billing details) and Resend (your email address and the text of a verification or reset message). Both are covered by the safeguards listed above. Neither receives order or buyer data.

Notice of changes

Before we add a sub-processor, or give an existing one access to a new category of data, we will update this page and email the address on your account at least 30 days beforehand.

You may object during that period. If we cannot address the objection you may cancel your subscription and export your data; see Terms of Service. We will not make the change for your account while a reasonable objection is outstanding.

Contact

Questions about this list, or a request for our data processing agreement: privacy@stockaroo.com.

Security issues should go to security.txt instead, which explains how to report one.