Sub-processor list
Date of this list: 8 November 2026. Version 1.0.
Draft awaiting legal review. Text in square brackets marks what is still to be decided or completed.
This page is a translation. The Spanish version is the binding one; you can switch language in the menu at the top.
1. What a sub-processor is
When a Seller uses cataloop, we process the data of its Shop's Buyers on the Seller's behalf. For that Buyer Data, the Seller is the controller and we, Weston Trade SL, are the processor (Art. 28 of Regulation (EU) 2016/679, GDPR).
A sub-processor is another company we use to provide the Service and which, in doing so, stores or carries Buyer Data on our behalf (Arts. 28(2) and 28(4) GDPR).
The rules that apply to sub-processors are in the Data processing agreement (the "DPA"), in its section "Sub-processors". This list names the providers and is the part that changes over time.
The table also includes the providers that process only Sellers' data, such as the payment provider. For that data we are the controller, as the Privacy policy explains. This way you have every company that processes data for the Service in one place.
If you are a Buyer, the Seller you order from is the controller of that Order's data. To exercise your rights over it, contact the Seller.
2. The table
When a provider processes data outside the European Economic Area, the transfer needs a safeguard. We use two: the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) and, in addition, the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). There is also a transfer when the data is stored in the European Union but the provider accesses it from outside the European Economic Area.
| Provider | Service | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| ProviderRailway Corporation (United States) | ServiceHosting of the application and its scheduled jobs. | DataAll traffic, Visitors' IP addresses and server logs. | LocationEuropean Union (Amsterdam). Railway states that it carries out its main processing in the United States. | Transfer safeguardEU-US Data Privacy Framework and standard contractual clauses |
| ProviderDatabricks, Inc. (United States), parent of Neon, LLC | ServiceDatabase (Neon), run on AWS. | DataAll Seller and Buyer data, and the IP addresses held by the attempt limits. | LocationEuropean Union (Frankfurt). | Transfer safeguardEU-US Data Privacy Framework and standard contractual clauses |
| ProviderCloudflare, Inc. (United States) | ServiceDNS, without proxy (Cloudflare does not see the website's traffic), and mail forwarding (Email Routing), which forwards messages without storing them. | DataThe mail that reaches our addresses, which may include Buyer data if the sender includes it. | LocationCloudflare's global network. | Transfer safeguardEU-US Data Privacy Framework and standard contractual clauses |
| ProviderCloudflare, Inc. (United States) | ServiceFile storage (R2): photos and logos, public; invoices, documents and exports, private. | DataProduct photos and logos; invoices with Buyers' names, tax IDs and addresses; exports. | LocationWestern Europe. This is the location we have asked Cloudflare for, which it applies where it can but does not guarantee. | Transfer safeguardEU-US Data Privacy Framework and standard contractual clauses |
| ProviderBunnyWay d.o.o. (Slovenia) | ServiceImage content delivery network (CDN). | DataProduct photos and logos, and the IP addresses of whoever views them. | LocationIt stores no files of its own: only temporary copies of the images it takes from R2, on its servers in the European Union. | Transfer safeguardNo transfer: European Union company |
| ProviderPlus Five Five, Inc. (United States), which provides the Resend service | ServiceTransactional email. | DataEmail addresses and message content: the Buyer's name, WhatsApp, email, notes and tax ID in notices to the Seller, and the name and Order link in messages to the Buyer. Each message carries the Shop's identifier and the type of message. | LocationEuropean Union (Ireland) for sending. Account data and logs are in the United States. | Transfer safeguardEU-US Data Privacy Framework and standard contractual clauses |
| ProviderStripe Payments Europe, Limited (Ireland) | ServiceSellers' payments: charging, subscriptions, invoices, refunds and customer portal. It acts as our processor for the payment service and as an independent controller for its own purposes, such as preventing fraud and meeting its legal obligations. | DataOwner email, business name, card, billing address and tax ID. It receives no Buyer data. | LocationIreland. Under its contract, it also processes data in the United States. | Transfer safeguardEU-US Data Privacy Framework (Stripe, LLC) and standard contractual clauses |
| ProviderFunctional Software, Inc. (United States), which provides the Sentry service | ServiceServer error reports. | DataScrubbed error events and the Shop identifier. | LocationEuropean Union. | Transfer safeguardEU-US Data Privacy Framework and standard contractual clauses |
| ProviderGoogle Cloud EMEA Limited (Ireland), which provides Google Workspace | ServiceMailbox that receives the mail sent to our support, privacy, legal notice and billing addresses. | DataThe messages you write to us, which may include Buyer data if the sender includes it. | Location[COMPLETAR SP-52: Google Workspace data region, if the edition allows it] | Transfer safeguardEU-US Data Privacy Framework (Google LLC) and standard contractual clauses |
3. Where our infrastructure is
Under Regulation (EU) 2023/2854, the Data Act (Art. 28), we publish where the infrastructure we process your data with is located and what measures we take against access by governments outside the European Union.
The application and the database are in the European Union, in Amsterdam and Frankfurt. The files are in Western Europe: this is the location we have asked Cloudflare for, which it applies where it can but does not guarantee. Several providers are US companies or part of their groups, and US law may allow US authorities to ask them for data. To reduce that risk:
- we choose European Union regions where the provider allows it;
- connections are encrypted and the database is encrypted at rest;
- where the standard contractual clauses apply, the provider must tell us of any request from an authority, unless the law forbids it, and check whether the request is lawful.
4. How we tell you about a change and how you can object
We keep this list up to date. Each time we change it, we update the date shown at the top. If we stop using a provider, we remove it from the list.
Before we add a sub-processor or replace one that processes Buyer Data, we tell Sellers by email to the Owner and with a notice in the Back office, at least 30 days in advance (Art. 28(2) GDPR).
If you are a Seller and you do not agree with a change, you can object within that period by email to privacidad@cataloop.app. Tell us the reason in that message. The DPA explains what happens if we cannot reach an agreement.
5. Which services are not sub-processors
Some services appear when someone uses a Shop, but they do not process data on our behalf. That is why they are not in the table:
- Videos hosted on another service that the Seller adds to a product page. They load only if the Buyer presses the play button; the Buyer's browser then loads them directly from that service. We send no data to that service: it receives from the browser what any website receives, such as the IP address. The Cookie policy explains this.
- WhatsApp links. They carry a phone number and, sometimes, a ready-written message, and the person decides whether to open WhatsApp. We send no data to WhatsApp.
- The Agencia Tributaria (the Spanish Tax Agency). When the Invoicing module works with tax validity, it will receive the records of the Seller's invoices because the law requires it. It is a recipient under the Seller's legal obligation, not a sub-processor.
- GitHub and the machines that run our automated tests. We use them for the code and for testing it. They hold no production data, and test tools are blocked from the production database.
6. Language
This list is published in Spanish and in English. If the two versions differ, the Spanish version prevails.