Legal
Sub-processors
Version 1.0.0 · last updated 29 Σεπτεμβρίου 2026
Draft – pending legal review
Available in English
KELHOS BRAND LLC ("Clawzia") uses the service providers below to provide the Clawzia service. This list is Annex 3 of our Data Processing Agreement (external link).
Sub-processors for data we process on behalf of merchants
These providers may process personal data of the merchants' consumers (withdrawal statements and cancellation declarations) on behalf of Clawzia. Clawzia itself is established in the United States; transfers from merchants to Clawzia are covered by section 13 of the Data Processing Agreement.
| Service | Provider | Purpose | Personal data concerned | Location | Transfer mechanism |
|---|---|---|---|---|---|
| Hosting | Virtual server host (network operated by HostPapa / ColoCrossing; contracting entity to be confirmed) | Virtual private server for the application, the database and the email queue | All data stored in the service, including withdrawal records | Buffalo, New York, United States | The data stays in the United States. The provider supplies infrastructure only (a virtual server), under its standard hosting terms. No separate data processing agreement has been concluded with it. The data is protected by our own measures: access control, encrypted connections and encrypted backups (see Annex 2 of the Data Processing Agreement) |
| Email delivery | Plus Five Five, Inc. (trading as Resend) | Sending acknowledgement emails to consumers and notifications to merchants | Recipient email address, name, content of the withdrawal statement in the email, receipt link, delivery status | United States: the provider states that its primary processing takes place there. The sending region chosen for our domain is Ireland (Amazon Web Services region eu-west-1). The provider is established in the United States and uses further sub-processors, which its list at resend.com/legal/subprocessors (external link) currently shows as located in the United States | The provider's data processing addendum, which incorporates the EU standard contractual clauses (modules for controller-to-processor and processor-to-sub-processor transfers). The provider states that it participates in the EU-US Data Privacy Framework |
Backups. Encrypted database backups are stored on the same server as the database. At present no separate backup storage provider is used. If we add one, we will list it here and announce it as described under "Changes to this list".
Other providers (not sub-processors for consumer data)
| Service | Provider | Purpose | Personal data concerned | Role | Location | Transfer mechanism |
|---|---|---|---|---|---|---|
| Payment processing | Stripe, LLC | Checkout, payment processing, tax calculation and invoices for Clawzia subscriptions and the installation service, which Clawzia sells | Merchant billing data only (for example, billing name, email address, billing address, VAT number, invoices and payment details). Never consumer withdrawal or cancellation data. | Processes this data on behalf of Clawzia; for its own purposes, such as fraud prevention and its legal obligations as a payment service provider, under its own responsibility | United States. Stripe also processes data through its affiliates and sub-processors in other countries | Stripe's data processing agreement, which provides for the EU standard contractual clauses and the EU-US Data Privacy Framework |
| Support mailbox | Zoho Corporation (Zoho Mail) | Hosting of our mailbox contact@clawzia.com, in which we receive and answer support requests | Emails you send us and our replies (sender address, name, content). It does not receive withdrawal statements or cancellation declarations from the service | Processes this data on behalf of Clawzia | The data center region of our Zoho account (Zoho operates data centers in the United States, the European Union, India and other regions) | Zoho's data processing addendum, which is based on standard contractual clauses |
Changes to this list
We inform merchants of any intended addition or replacement of a sub-processor at least 30 days in advance, by email to the account owner. Merchants can object as described in section 7 of the Data Processing Agreement.
| Date | Change |
|---|---|
| 2026-09-29 | First published version. |
Clawzia is a technical tool and does not provide legal advice.