Subprocessor List
CIQRA OÜ · Version 2.5 · Last updated: 4 November 2026
This list identifies the third parties that CIQRA engages to process personal data in providing the CIQRA platform. It forms Annex III to the Data Processing Agreement and to the Standard Contractual Clauses incorporated into it, and is referred to in the Privacy Policy.
CIQRA OÜ, registry code 16465907, Veskiposti tn 2, 10138 Tallinn, Harju maakond, Estonia · info@ciqra.com
1. How to read this list
- CIQRA engages the providers in Sections 2 to 5 to process personal data on its behalf — as sub-processors where CIQRA processes Merchant Personal Data as a processor, and as processors where CIQRA processes personal data for its own purposes.
- Core hosting is in the EU. The platform's compute, database, file storage and key management run on Microsoft Azure in Germany.
- Where a provider is located outside the European Economic Area, or may access data from outside it, the transfer relies on the adequacy decision for the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) where the U.S. recipient is certified under it, and otherwise, and as a fallback, on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) — Module Three where CIQRA acts as processor, Module Two where it acts as controller — together with the UK Addendum and the Swiss amendments where relevant ("SCCs"). A summary of CIQRA's transfer impact assessment is in Section 9.
- Section 6 lists third parties that a Merchant chooses and contracts with directly, and recipients that receive personal data only where a visitor has given consent. For those, the Merchant is usually the controller, and CIQRA transmits data to them only on the Merchant's instructions.
- Search indexing runs on software operated by CIQRA within its own Azure environment in Germany and does not involve a separate sub-processor.
2. Core platform
| Provider | Service | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| Microsoft Ireland Operations Ltd (Microsoft Azure) | Hosting, compute, database, file storage, backups, secrets and key management | All data hosted on the platform | EU — Germany West Central; geo-redundant backups in Germany North; the redirect service for Storefront apex domains in Sweden Central | Processing within the EEA; SCCs for any access from outside the EEA |
| Microsoft Ireland Operations Ltd (Azure Communication Services) | Transactional email delivery | Recipient name and email address; message content | EU | Processing within the EEA; SCCs for any access from outside the EEA |
| Cloudflare, Inc. | Content delivery, DNS, web application firewall, protection against denial-of-service attacks and bots, custom domains, Turnstile bot protection | IP address, request metadata and headers | Global network; United States (parent company) | EU-U.S. DPF (where certified) and SCCs |
3. Payments
| Provider | Service | Personal data | Location | Basis |
|---|---|---|---|---|
| Stripe Payments Europe, Limited (Ireland) and Stripe, Inc. (United States) | CIQRA Pay: payment processing, Stripe Connect accounts, identity and business verification, fraud prevention, payouts | Payment and transaction data; verification and beneficial-ownership data. Full card numbers are captured by Stripe and never reach CIQRA. | EU and United States | Stripe acts largely as an independent controller under its own terms; EU-U.S. DPF (where certified) and SCCs for transfers to the United States |
4. AI services
This provider receives data only when an AI feature is used, and it is the only AI provider CIQRA uses. See the AI Features Terms.
| Provider | Service | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| Microsoft Ireland Operations Ltd (Microsoft Azure AI Foundry, with the Azure OpenAI models) | Text generation, translation, embeddings for search and recommendations, image generation and editing, and the AI assistants | Minimised inputs and outputs of the feature used; e-mail addresses, telephone numbers, card numbers and IBANs are replaced with placeholders by default | EU Data Zone deployments only: CIQRA's Azure accounts in Germany West Central (text and embeddings) and Sweden Central (images) | Processing within the EEA; Microsoft's data-protection terms for Azure, with SCCs for any access from outside the EEA |
5. Security and business services
| Provider | Service | Personal data | Location | Basis |
|---|---|---|---|---|
| Google Cloud EMEA Limited (reCAPTCHA) | Bot protection on forms where the website operator enables it (see Section 4.1 of the Cookie Policy) | Device and interaction data from the protected form; IP address | Ireland; Google's global infrastructure | Google acts as processor under the Google Cloud Data Processing Addendum; EU-U.S. DPF (where certified) and SCCs |
| Hosting Concepts B.V. (Openprovider) | Registration, renewal and transfer of domain names that a Merchant buys through CIQRA, on CIQRA's reseller account | Registrant contact data (name, organisation, postal address, email address, telephone number) | Netherlands (EU) | Processing within the EEA. The registrar and the registry of each top-level domain also process registration data as controllers under their own policies, as the domain-registration system requires |
| REKLAM BEŞ TANITIM VE BİLİŞİM HİZMETLERİ DANIŞMANLIK TURİZM SAN. TİC. LTD. ŞTİ. ("Reklam5") | Operation of the Microsoft 365 tenant that hosts CIQRA's business email. Reklam5 does not sell or invoice CIQRA's subscriptions. SEO or advertising services that Reklam5 provides to a Merchant are contracted directly between Reklam5 and that Merchant; for them Reklam5 is not CIQRA's sub-processor | Correspondence sent to and from CIQRA's email addresses, including any personal data it contains | Türkiye | SCCs (Module Two for CIQRA's own data; Module Three for Merchant Personal Data in support correspondence) |
6. Third parties chosen by Merchants, and consent-based recipients
These third parties receive personal data only where the Merchant has selected them for its Storefront and, where relevant, contracted with them directly, or, for consent-based technologies, where the visitor has given consent. CIQRA is not a party to the Merchant's contract with them.
| Recipient | Purpose | When data is shared | Basis |
|---|---|---|---|
| Google Ireland Limited — Google Analytics 4, Google Tag Manager, Google Ads | Analytics and advertising measurement | Analytics or marketing consent | Consent; SCCs |
| Intuition Machines, Inc. — hCaptcha | Bot protection on forms | Where the website operator selects it | SCCs |
| Meta Platforms Ireland Limited — Meta Pixel and Conversions API | Advertising measurement, including server-side events | Marketing consent | Consent; SCCs |
| TikTok Technology Limited and TikTok Information Technologies UK Limited | Advertising measurement | Marketing consent | Consent; SCCs |
| Pinterest Europe Ltd. | Advertising measurement | Marketing consent | Consent; SCCs |
| Snap B.V. | Advertising measurement | Marketing consent | Consent; SCCs |
| Microsoft Ireland Operations Limited — Microsoft Advertising | Advertising measurement, including server-side conversion upload with hashed email address and telephone number | Marketing consent | Consent; EU-U.S. DPF / SCCs |
| TrustedSite | Trust seal and purchase-conversion tag | Where the Merchant installs it | Under the Merchant's contract with the provider |
| Microsoft Ireland Operations Limited — Microsoft Clarity | Session replay and heat maps (analytics) | Where the Merchant enables it for its Storefront; it runs only after analytics consent where consent is required | Under Microsoft's terms with the Merchant; Microsoft's SCCs or the EU-U.S. Data Privacy Framework for any transfer |
| Tax calculation services selected by the Merchant (for example TaxJar) | Sales-tax calculation and filing | When the Merchant connects the service | Under the Merchant's contract with the provider |
| İleti Yönetim Sistemi A.Ş. (İYS), Türkiye | Recording commercial-message consent as required by Turkish law | When the Merchant connects its İYS account | The Merchant's legal obligation under Turkish law |
| Shipping carriers and label services selected by the Merchant (for example DHL, UPS, FedEx, Popout, Inc. d/b/a Shippo, Yurtiçi Kargo, Aras Kargo, MNG Kargo and PTT) | Shipping rates, labels and tracking | When the Merchant enables the carrier and ships an order | Under the Merchant's contract with the carrier |
| The SMS provider the Merchant selects and contracts with (for example Netgsm İletişim ve Bilgi Teknolojileri A.Ş., Emarka İletişim ve Bilgi Teknolojileri A.Ş. (İletimerkezi), Twilio, Vonage, MessageBird, Amazon SNS or an HTTP gateway of the Merchant's choice) | Transactional SMS sent from the Merchant's own provider account | When the Merchant configures SMS | Under the Merchant's contract with its provider |
| Sales channels and marketplaces connected by the Merchant (for example Temu, Faire and Shopify) | Listing products and synchronising orders and stock | When the Merchant connects the channel | Under the Merchant's contract with the channel operator |
| Payment providers selected by the Merchant other than CIQRA Pay (for example iyzico, PayTR and bank virtual POS providers) | Payment processing | When the Merchant connects the provider | Under the Merchant's contract with the provider |
7. Other recipients
Auditors, legal and financial advisers and public authorities may receive personal data where required by law or to establish, exercise or defend legal claims, and a buyer or successor may receive it in a merger, acquisition or reorganisation, subject to confidentiality. These recipients are not sub-processors.
8. Changes to this list
CIQRA may engage additional sub-processors, including providers of AI, monitoring or other services. CIQRA gives at least 30 days' notice of any intended addition or replacement of a sub-processor by updating this list and notifying Merchants by email or in the dashboard. Merchants may object under Section 5.2 of the Data Processing Agreement. In urgent cases involving the security or continuity of the Services, Section 5.3 of the Data Processing Agreement applies.
9. Transfer impact assessment — summary
Assessed 2 October 2026; reviewed 18 October 2026, when AI image generation moved to an EU Data Zone deployment in Sweden Central and the domain registrar was added (both within the EEA, so neither adds a restricted transfer); reviewed 30 October 2026, when Reklam5's role was narrowed to operating CIQRA's business email (it no longer sells or invoices subscriptions, so it no longer receives customers' billing data).
9.1 Recipients in the United States. Since 10 July 2023 transfers to U.S. recipients certified under the EU-U.S. Data Privacy Framework are covered by the adequacy decision in Commission Implementing Decision (EU) 2023/1795, which the General Court upheld in Case T-553/23 Latombe v Commission (3 September 2025). For Microsoft, Cloudflare, Stripe and Google, CIQRA relies on that decision where the recipient is certified and, in every case, on the SCCs incorporated in the provider's data processing terms. Assessment: low risk. Platform data is stored and processed in the EU (Microsoft Azure, Germany; AI on EU Data Zone deployments in Germany and Sweden). Cloudflare handles traffic data in transit over TLS. Stripe acts largely as an independent controller. reCAPTCHA receives no server-side IP address from CIQRA. Data is encrypted in transit and at rest, with per-tenant keys held in CIQRA's Azure Key Vault.
9.2 Reklam5 (Türkiye). There is no adequacy decision for Türkiye, and Turkish law gives public authorities powers of access to data (including Law No. 2937 on State Intelligence Services) that may not meet the EU standards of necessity and proportionality. The data concerned is limited to CIQRA's business email. Transfers are made under the SCCs (Module Two for CIQRA's own data; Module Three for Merchant Personal Data in support correspondence), with supplementary measures: multi-factor authentication, no access to the platform database, and no bulk export of Merchant Personal Data. Assessment: medium risk, acceptable with these measures.
9.3 Review. CIQRA reviews this assessment whenever a sub-processor, a destination country or the relevant law changes, and at least once a year.