This Appendix forms part of Zippendo's Data Processing Agreement (Danish Datatilsynet standard contractual clauses, Article 28(3) GDPR). It corresponds to Appendix B in the published DPA template.
B.1 Approved sub-processors
On commencement of the Clauses, the Customer gives general written authorisation for Zippendo to engage subprocessors to provide core platform and hosting services, subject to the conditions in this Appendix.
The current, authorized sub-processors engaged by Zippendo are listed in Section B.1.1 and B.1.2. An up-to-date list is maintained publicly at: https://zippendo.com/legal/subprocessor-list
B.1.1 Core Sub-processors
| Sub-processor | Purpose / Service Provided | Location of Processing |
|---|---|---|
| Cloudflare, Inc. | Edge network services for Zippendo's public-facing endpoints (websites, web application, API, and supporting services): reverse proxy, TLS termination, content delivery, Web Application Firewall (WAF), bot management (including Cloudflare Turnstile), and DDoS protection, together with related edge security, performance, and content-delivery services. Requests are inspected and forwarded in transit. | Global edge network (processing in transit); USA. Subject to the EU-US Data Privacy Framework (DPF) and EU Standard Contractual Clauses (SCCs) |
| Hetzner Online GmbH | Primary cloud infrastructure, application hosting, compute servers, caching layer, and document object storage | Falkenstein, Germany (EU/EEA) |
| Neon, Inc. | Managed relational database services and secure disaster recovery backups | AWS Frankfurt, Germany (EU/EEA) |
| Resend, Inc. | Transactional email delivery and notification services | AWS Ireland (EU/EEA) |
| PostHog, Inc. | Product analytics, diagnostic logging, session masking, and application error tracking | Frankfurt, Germany (EU/EEA) / USA (subject to DPF/SCCs) |
| Mapbox, Inc. | Interactive maps, geocoding, and address validation services | EU / USA (subject to DPF/SCCs) |
| GitHub, Inc. | Secure repository hosting, continuous integration, and pipeline deployment orchestration | EU / USA (subject to DPF/SCCs) |
B.1.2 Feature-Gated Sub-processors
The following sub-processors are engaged only when the Customer actively purchases, enables, or activates specific optional features (such as the Zippy AI Assistant):
| Sub-processor | Purpose / Service Provided | Location of Processing |
|---|---|---|
| Anthropic, PBC | Optional AI text chat processing (Zippy AI Assistant) for customer queries; data processed strictly for inference with model training disabled. | USA (subject to EU Standard Contractual Clauses, Module 3 (Processor-to-Processor)) |
B.1.3 Carriers (Independent Data Controllers — Not Sub-processors)
Carriers and transport providers available for integration within the platform are not subprocessors under this Agreement.
Carriers process shipment and consignment data as independent data controllers under their own terms and privacy notices for the purpose of executing physical transport. The Customer's activation of a carrier integration within the platform constitutes a direct documented instruction from the Customer (as data controller) to Zippendo to disclose the necessary consignment data to that carrier.
B.2 Prior notice and changes
Zippendo must notify the Customer in writing at least 14 days before adding, replacing, or changing a core or feature-gated sub-processor. Notification is provided by:
- Direct email to the Customer's registered organization administrator email addresses on file; and
- Updating the public subprocessor changelog at zippendo.com/legal/subprocessor-list.
B.3 Objection mechanism
If the Customer has reasonable, documented data protection grounds to object to a new sub-processor, the Customer must notify Zippendo in writing within the 14-day notice period.
An objection does not have suspensive effect on platform operations. If the parties are unable to resolve the objection through good-faith consultations, either party may terminate the subscription and this Agreement by providing written notice before the new sub-processor commences processing, without further liability or penalty.
B.4 Contractual safeguards
Zippendo shall impose data protection obligations on all subprocessors that are no less restrictive than those set out in these Clauses. Zippendo remains fully liable to the Customer for the performance of each subprocessor's obligations.
Subprocessor contracts shall include a third-party beneficiary clause allowing the Customer to instruct the subprocessor to erase or return personal data in the event that Zippendo ceases to exist, dissolves, or becomes insolvent.