Sub-processors and Third-Party Recipients

The following sub-processors are engaged by Pircel under Article 28 GDPR contracts. Each is bound by data protection obligations consistent with our own.

Notes on this list

• Where personal data is processed within the European Economic Area but the corporate provider is headquartered outside the EEA (for example, in the United States), Standard Contractual Clauses (Commission Decision (EU) 2021/914) are in place to address any extraterritorial access by the provider's personnel — for example, by support engineers. This approach follows the European Data Protection Board's guidance subsequent to Schrems II (Case C-311/18).
• Where data is processed outside the EEA, we rely on a combination of the EU–US Data Privacy Framework (where the recipient is self-certified) and Standard Contractual Clauses, supplemented by appropriate technical and organisational measures.
• Some of these sub-processors themselves rely on further sub-processors (for example, AWS underlies MongoDB Atlas and Heroku). The list above reflects the parties with which Pircel contracts directly; further sub-processor information is available in each provider's published documentation and upon request.

The following third parties receive personal data through the Service but act as independent data controllers, not as Pircel's sub-processors. This classification follows the European Data Protection Board's Guidelines 07/2020 on the concepts of controller and processor under the GDPR, which identify postal and courier service providers as a typical example of independent controllers.

When a shipment is created, the relevant End Recipient personal data (name, postal address, phone, email where applicable, and shipment metadata such as COD amount and parcel details) is transmitted from the Service to the carrier chosen by the Customer or End Recipient. Each carrier processes that data for its own purposes (performance of the delivery contract, regulatory compliance, customs declarations, postal-sector retention obligations) and under its own privacy notice.

Notes on this list

• Each carrier's privacy notice governs its independent processing. Links to those notices are typically available from the carrier's own website.
• Where carriers are headquartered outside the EEA (FedEx, UPS), Customers are responsible for assessing the transfer implications in the context of their own data-controller obligations to End Recipients. Pircel facilitates the data transmission as the Customer's processor; the legal basis and transfer mechanism for the carrier's independent processing is established between the Customer (or End Recipient) and the carrier.
• Pircel does not exercise control over the carriers' security practices, retention periods, or onward disclosures.

The following systems are operated by, or on behalf of, our Customers. Data flowing between the Service and these systems is initiated by the Customer in their role as data controller. We do not list these as sub-processors because we do not engage them; the Customer does.

When the Customer connects one of these platforms to the Service, the Service exchanges data with that platform under the Customer's authorization (e.g., reading product catalog data, receiving order data). The Customer is the data controller in respect of data resident in that platform.

The following third parties are referenced from the Website as outbound links. We do not transmit personal data to them; if you click the link and interact with them, your interaction is governed by their own privacy notices.

We do not embed these services as iframes or scripts on our pages; they are simple outbound links.

We may add, replace, or remove sub-processors and other third parties from time to time as our infrastructure and integrations evolve. Material changes to our list of sub-processors (Section 1) will be reflected on this page with a revised "Last Updated" date.

For Customers: in accordance with our Data Processing Agreement, we will notify you of material changes to our sub-processor list at least thirty (30) days before the change takes effect, where reasonably practicable, so that you have an opportunity to object. Notification is given by updating this page and, where applicable, by email.

To receive notifications by email when this page is updated, contact us at privacy@pircel.com.

Questions about this page, our sub-processors, or any data-processing relationship described here:

For more information, please refer to our Privacy Policy, Cookie Policy, and Terms of Service.