Sub-processor List
This page lists the third-party sub-processors that Vantemo (Inovacijų dialogas, MB) engages to process personal data on behalf of merchants in connection with the Vantemo platform. It is maintained in accordance with Article 5 of our Data Processing Agreement.
Merchants who have accepted the DPA are deemed to have granted general authorisation to the sub-processors listed below as of the DPA effective date. Where a new sub-processor is added or an existing one materially changed, merchants will receive at least 30 days' advance notice and may object in accordance with DPA Art. 5.3.
This list is a superset of the DPA Annex B. Most entries are sub-processors that handle end-customer personal data on Vantemo's behalf, and the general authorisation and objection right described above apply to them. It also includes, for transparency, providers that sit outside that arrangement — in particular NameSilo, the domain registrar, which acts as an independent controller of the registrant details it receives and is therefore not a DPA Annex B sub-processor and not part of the general authorisation above.
Current Sub-processors
| Sub-processor | Country | Purpose | Transfer mechanism |
|---|---|---|---|
| Stripe Inc. | USA | Payment processing infrastructure (platform and merchant billing; merchant payouts via Stripe Connect) | EU-US Data Privacy Framework + Standard Contractual Clauses |
| MakeCommerce (Maksekeskus AS) | Estonia / EU | Storefront payment processing (card, bank, and LP Express), where enabled by the merchant. Processes end-customer payment and contact details. | EU-based; no international transfer |
| Amazon Web Services — Simple Email Service (SES) | Sweden / EU (eu-north-1) | Transactional and marketing email delivery on behalf of merchants. Processes recipient email addresses, email content, bounce/complaint events, and email engagement (open/click) events. Data is processed in the AWS eu-north-1 region (Stockholm, Sweden) — no transfer outside the EEA. | EU-based processing; no international transfer required |
| Amazon Web Services — SNS / SQS | Sweden / EU (eu-north-1) | Message queue for SES bounce/complaint event notifications. Routes delivery events (bounce type, complaint reason) from SES to Vantemo's processing pipeline. No email body content is stored in SQS. | EU-based processing; no international transfer required |
| Cloudflare Inc. | USA (R2 object storage placed in Western Europe by a best-effort location hint — not a contractual EEA-residency guarantee) | Content delivery network, DDoS protection, SSL termination, and DNS management, plus object storage (Cloudflare R2) for merchant media, generated invoice PDFs, and uploaded files. For email, Cloudflare manages DNS records for the send.vantemo.com sending zone (DKIM CNAME records, SPF, DMARC). Where the merchant turns on email forwarding, Cloudflare Email Routing forwards mail sent to the merchant's domain to the inbox the merchant chooses. It processes the email content in transit and the sender, recipient and subject metadata. | EU-US Data Privacy Framework + Standard Contractual Clauses |
| NameSilo LLC | USA | Domain registration. Processes the registrant contact details (name, email, phone, address) a merchant provides when purchasing a domain through Vantemo. Default WHOIS privacy is enabled; registrant data is transmitted onward to the relevant TLD registry and ICANN-mandated data escrow. This is merchant account data, so NameSilo is listed here but not in the DPA Annex B (which covers end-customer data). | Standard Contractual Clauses |
| Hostinger | Lithuania / EU | VPS infrastructure — primary data hosting for all platform data | EU-based; no international transfer |
| PostHog Inc. — marketing site | EU (PostHog Cloud EU, Frankfurt) | Product analytics for the vantemo.com marketing website (Vantemo's own site visitors — not merchant or end-customer storefront data). Ingested via Vantemo's EU reverse proxy. | EU-based; no international transfer |
| PostHog Inc. — merchant dashboard | USA | Platform-level product analytics for the merchant dashboard (dashboard usage — not end-customer storefront data). | EU-US Data Privacy Framework (participant #2915) + Standard Contractual Clauses |
| Twilio Inc. | USA | SMS delivery (cart-recovery notifications and merchant sender-ID verification/OTP). Processes end-customer phone numbers and message content. | EU-US Data Privacy Framework + Standard Contractual Clauses |
| Sentry (Functional Software, Inc.) | USA | Error monitoring and performance tracing across the platform. Processes IP addresses, request metadata, and stack traces. | EU-US Data Privacy Framework + Standard Contractual Clauses |
| Anthropic PBC | USA | AI assistant / store-management chat, plus safety and intent classification. May process end-customer names and emails returned by the assistant's store-data tools. No model training on your data. | Standard Contractual Clauses (via the provider's data processing terms) — not DPF-certified |
| OpenAI, L.L.C. | USA | Retrieval embeddings for the AI assistant (RAG) and optional content generation. | Standard Contractual Clauses (via the provider's data processing terms) |
| Google LLC (Gemini API) | USA | AI ad-creative generation. | EU-US Data Privacy Framework + Standard Contractual Clauses |
| DeepL SE | Germany / EU | Machine translation of merchant and store content. | EU-based when DeepL is used; store content may fall back to OpenAI (USA) under SCCs if DeepL is unavailable |
Each sub-processor listed above may engage its own sub-processors (for example, cloud-hosting or telecommunications providers). In accordance with EDPB Opinion 22/2024 (adopted 7 October 2024), Vantemo maintains, and will provide on request, the identity and location of the sub-processors in this downstream chain. Additions or replacements at the first tier are notified at least 30 days in advance (DPA Art. 5.2).
Change History
| Date | Change |
|---|---|
| 12 October 2026 | v1.4 — Cloudflare entry now discloses Cloudflare Email Routing (inbound forwarding of mail sent to the merchant's domain, where forwarding is enabled), matching DPA Annex B. No new sub-processor and no transfer-mechanism change. DPA article citations corrected to the public DPA's numbering. |
| 8 July 2026 | v1.3 — EU-US DPF participant status re-verified via a live dataprivacyframework.gov lookup: Stripe, Cloudflare, Amazon (AWS parent), Twilio, Sentry, and Google confirmed DPF-Active; OpenAI and Anthropic confirmed not on the DPF list (SCCs only). No sub-processor added, removed, or changed and no transfer-mechanism value changed — verification-only revision resolving the prior "OpenAI DPF status pending re-verification" note. |
| 7 July 2026 | v1.2 — Synced with DPA Annex B v1.1. Added Twilio (SMS), Anthropic, OpenAI, Google (Gemini) and DeepL (AI and translation), MakeCommerce (storefront payments), and NameSilo (domain registration). Added Cloudflare R2 object storage to the Cloudflare entry. Split PostHog into two rows — vantemo.com marketing analytics (EU, Frankfurt) and merchant-dashboard analytics (USA, EU-US DPF #2915 + SCCs). Added a downstream sub-processor-chain disclosure. Added Sentry (error monitoring) — EU-US DPF + SCCs. Corrected Google's transfer mechanism to EU-US DPF + SCCs (was mislabeled SCCs-only); clarified Anthropic as SCCs only, not DPF-certified. |
| 1 May 2026 | v1.1 — Updated AWS SES entry to specify eu-north-1 (Stockholm) region and clarify no EEA transfer. Added AWS SNS/SQS entry. Updated Cloudflare entry to include DNS/email role for send.vantemo.com zone. |
| 1 March 2026 | Initial list published (v1.0) |
Questions
To object to a sub-processor or request further information about our data transfers, contact [email protected].