Subprocessor Register
Last updated: 12 September 2026
This register lists suppliers Savrena authorises to process Customer Personal Data on Savrena's behalf. It forms Annex III of the Data Processing Addendum.
| Provider | Purpose | Processing location | Data involved |
|---|---|---|---|
| Hostinger PTE LTD 16 Raffles Quay, #33-03, Hong Leong Building, Singapore 048581 gdpr@hostinger.com | Virtual server, network and infrastructure hosting | Mumbai, India; support or account operations may occur from Hostinger group locations | Encrypted network traffic, application data stored by Savrena on the virtual server, and infrastructure logs |
| Cloudflare, Inc. 101 Townsend St., San Francisco, CA 94107, United States Data Protection Officer: privacyquestions@cloudflare.com | DNS, reverse proxy, TLS edge, traffic protection and availability | Cloudflare global edge network; requests are routed through an available edge location | IP address, request metadata and encrypted application traffic transiting the proxy |
| Cloudflare, Inc. (R2 object storage) 101 Townsend St., San Francisco, CA 94107, United States Data Protection Officer: privacyquestions@cloudflare.com | Off-site storage of encrypted database backups | R2 bucket with automatic placement in the Asia-Pacific region. Automatic placement is not a residency guarantee and is not restricted to India | A complete daily backup of the Savrena database, which contains Customer Personal Data in the same form the production database holds it: hashed identifiers, redacted event payloads, coarse geo, IP address and user agent. Retained as the 30 most recent copies |
Destination platforms
Advertising and analytics destinations are not subprocessors of Savrena. Meta and Google receive data only when the Merchant selects and configures that destination. They process under their own agreement with the Merchant and may have a different legal role for each service.
Changes and objections
Savrena will notify affected Merchants directly at least 30 days before a new subprocessor begins processing Customer Personal Data. A Merchant may object during that period on reasonable data-protection grounds by emailing support@savrena.com. The process and available remedies are in section 6 of the DPA.
Scope note
Cloudflare appears twice because it performs two distinct activities. As the edge it only sees traffic in transit; as R2 it stores a complete copy of the database. Listing them together would hide the second, which is the one that matters to a Merchant assessing where their data rests.
Dokploy and PostgreSQL are self-hosted software in Savrena's Hostinger environment, not separate processing companies. Source hosting and development tools are not authorised to receive production Customer Personal Data. A transactional email provider is not authorised to receive shopper event data under this DPA.