Legal
Subprocessor List
Last updated: Aug 26, 2026
Policies
Subprocessor List
Emersoft Books Shopify Application | Version 1.1
This document identifies third parties currently known to process personal data on behalf of the Emersoft Contracting Entity in connection with the Emersoft Books application. It should be read with the Data Processing Agreement and Privacy Policy.
Role warning
Shopify, Ingram, Gardners and Pubnet are not automatically Emersoft Subprocessors. Their role depends on the relevant merchant, platform, supplier and fulfilment agreements. They are listed separately as platforms or recipients.
Provider | Service | Location | Data | Status / safeguard |
|---|---|---|---|---|
Hetzner Online GmbH | Application hosting and compute | Ashburn, Virginia, US | App, merchant, order, fulfilment and technical data | Subject to applicable provider DPA and transfer safeguards where required |
DigitalOcean, LLC | Managed database hosting | New York City, New York, US | Merchant configuration, order, fulfilment and app records | Provider DPA available; SOC 2 Type II reported by provider; applicable transfer safeguard to be maintained where required |
Amazon Web Services, Inc. | Docker/container storage and encrypted offsite backup storage | us-east-1, US | Docker/container storage and GPG-encrypted database backups | Subject to AWS data-processing terms and applicable transfer safeguards where required |
Cloudflare, Inc. | DNS, CDN, proxy, TLS and WAF | Global network; processing locations depend on service configuration and applicable Cloudflare terms | IP address, request and security metadata; transient traffic | Subject to Cloudflare customer DPA and applicable transfer safeguards where required |
Grafana Cloud / applicable provider entity under Emersoft's subscription | Cloud logging, monitoring and alerts | US East (Ohio), US | Application logs and technical events; 30-day retention | US East (Ohio) and 30-day retention confirmed; subject to applicable provider DPA and transfer safeguards where required |
Notice of changes
Emersoft will provide reasonable advance notice of a new Subprocessor that will materially process Merchant Personal Data, normally at least 30 days where practicable. A merchant may object on reasonable data-protection grounds under the DPA.
Scope notes
Atlassian Bitbucket CI/CD is used for deployment automation with limited deployment-only access. It is not listed as a Subprocessor on current information because processing of Merchant Personal Data in CI/CD logs, artefacts or deployment metadata has not been confirmed. If that changes, this list will be updated and appropriate safeguards applied before such processing.
Discord operational alerts are confirmed to be technical-only and not to contain personal data, so Discord is not listed as a Subprocessor for this processing.
If an Emersoft affiliate processes Merchant Personal Data on behalf of the Contracting Entity, the affiliate will be added to this list and treated as a Subprocessor where required.
Emersoft must maintain and periodically verify applicable provider DPAs and international-transfer safeguards. Publication of this list does not by itself replace those underlying contractual obligations.
Platforms and fulfilment recipients
Provider | Relationship |
|---|---|
Shopify | Source platform and merchant service provider. Role governed by the Shopify merchant agreement. |
Ingram Content Group | Receives order and delivery information for enabled Consumer Direct Fulfilment and related services. |
Gardners | Receives order and delivery information for enabled UK home-delivery services. |
Pubnet | Supports EDI purchase-order workflows. Its legal and data-protection role is governed by the merchant’s Pubnet and supplier agreements and may vary by implementation. |
Google, Meta and TikTok | Listed as integrations. They are not treated as order-data Subprocessors unless they process merchant customer personal data on Emersoft’s behalf. Separate website or sales-channel processing is governed by the relevant configuration and provider terms. |
Contact
Questions or objections concerning this list may be sent to [email protected].