The companies COEC uses to run ShopAssist, what they process and where. We announce every new sub-processor 30 days in advance.
Organization owners, admins and security contacts are emailed 30 days before a new sub-processor is added or a listed one changes. You can object within that period by writing to privacy@coec.dk. For managed-AI sub-processors, you can switch to your own AI key; otherwise you can end the affected service.
Your own AI provider, helpdesk and webhook endpoints are not our sub-processors: they receive data on your instruction, under your agreement with them.
| Sub-processor | Service | Personal data | Processing location | Transfer basis | Applies to | Since |
|---|---|---|---|---|---|---|
| Hetzner Online GmbH (Germany) | Compute, dedicated database server, object storage, backup repository 1 (separate project), uptime monitoring VM | All service data |
| EEA | All plans | |
| Scaleway SAS (France) | Transactional email: transcripts, one-time codes, back-in-stock alerts, double opt-in, action confirmations, merchant notifications | Recipient address, email content |
| EEA | All plans | |
| Scaleway SAS (France), Object Storage fr-par | Encrypted backup repository 2 | Encrypted database backups |
| EEA | All plans | |
| Functional Software, Inc. d/b/a Sentry (USA) | Error monitoring in the EU data region (Frankfurt) | Scrubbed error context: pseudonymous ids and request paths. No request bodies, no IP addresses |
| SCCs (Module 3) and the EU–US Data Privacy Framework where certified | All plans | |
| Microsoft Ireland Operations Ltd (Azure OpenAI, EU Data Zone deployments only) | Managed AI, primary provider | Conversation content and tool results sent for generation |
| EEA entity (Microsoft DPA including SCCs for any remote access) | Managed AI | |
| Mistral AI SAS (France) | Managed AI, fallback provider | Conversation content and tool results sent for generation |
| EEA | Managed AI | |
| Google Cloud EMEA Ltd (Vertex AI, EU regional or eu multi-region endpoints only; caching and grounding disabled) | Managed AI, second fallback provider | Conversation content and tool results sent for generation |
| EEA entity (Google Cloud DPA including SCCs) | Managed AI |
No changes since launch.