Sub-processors
Effective from: 14 October 2026. Last updated: October 2026. Previous versions: available on request at legal@complete-solution.eu.
This page lists the sub-processors engaged by Complete solution s. r. o. (IČO 56693371) for the processing of personal data on behalf of our clients. We update this list when sub-processors are added or replaced and notify clients with active Data Processing Agreements at least 30 days in advance. To subscribe to update notifications, email privacy@complete-solution.eu.
1. Vitrina Platform — Sub-processors
Providers that Complete solution s. r. o. engages under its own contracts to run the Vitrina Platform for a client. Each client has a separate deployment and a separate database.
Appendix IV (Part A) to the Data Processing Agreement signed with a client (Schedule 2 to the Master Agreement) is an extract of this section for that client's deployment as at the date of signing, with the rows that are not enabled in the deployment removed. This page is updated before or at the same time as the 30-day notice to clients; until the notice period has expired, the signed Appendix IV prevails over this page.
| Sub-processor | Location | Purpose | Personal Data Categories | Transfer Mechanism | When engaged |
|---|---|---|---|---|---|
| Railway Corp. | USA (company); processing region selected per deployment, an EU region where the provider offers it | Hosting of the back end and the PostgreSQL database, scheduled jobs, nightly backup job | All client personal data | EU-US Data Privacy Framework (where the provider is certified) or SCC 2021/914 Module 3 | Always |
| Vercel Inc. | USA (company); function region selected per deployment | Hosting of the ordering website and the admin panel | IP addresses, request data, data passing through server-side page rendering, session cookies, images uploaded by guests during image optimisation | EU-US Data Privacy Framework (where the provider is certified) or SCC 2021/914 Module 3 | Always |
| Cloudflare, Inc. — R2 storage | USA (company); buckets without the EU jurisdiction: the storage location is not guaranteed by the provider, even where a location hint is set for the bucket | Storage of images and of encrypted database backups | Avatars and photos; all client personal data in encrypted form (backups are AES-256-encrypted before upload) | EU-US Data Privacy Framework (where the provider is certified) or SCC 2021/914 Module 3 | Always |
| Cloudflare, Inc. — proxy, DNS and Turnstile | USA (company); global network | Proxying of traffic to the back end with TLS termination; bot verification | Data passing between users' devices and the back end (not stored, except the provider's technical logs); IP addresses; browser or device data; verification tokens | EU-US Data Privacy Framework (where the provider is certified) or SCC 2021/914 Module 3 | Where the DNS of the client's domain and the verification widget are managed in our account |
| GitHub, Inc. | USA; standard GitHub-hosted runners of GitHub Actions, no region is selected | Weekly backup restore test (temporary deployment of a full database copy) | All client personal data, temporarily during the test | EU-US Data Privacy Framework; SCC 2021/914 incorporated in the GitHub Data Protection Agreement | Always |
| Sentry (Functional Software, Inc.) | USA (company); data stored in the EU (Germany) ingest region | Error monitoring and sampled performance tracing of the back end, the website and the apps | Technical error context: user identifier, request URL after scrubbing, device data | EU-US Data Privacy Framework (where the provider is certified) or SCC 2021/914 Module 3 | Always |
| Expo (650 Industries, Inc.) | USA | Building and signing of the mobile apps; relay of push notifications | Push tokens, text of push notifications; the app builds contain no client personal data | EU-US Data Privacy Framework (where the provider is certified) or SCC 2021/914 Module 3 | With the guest mobile apps |
| Google (Google LLC / Google Ireland Limited) — Firebase Cloud Messaging, Google Play Console | USA / Ireland | Delivery of push notifications to Android devices; publication of the Android apps under our developer account | Push tokens, text of push notifications; device data in crash reports; names of the authors of public ratings and reviews | EU-US Data Privacy Framework (where the provider is certified) or SCC 2021/914 Module 3 | With the guest mobile apps |
| Resend (Plus Five Five, Inc.) | USA | Sending of emails (verification codes, receipts, order notifications) | Email address, name, email content | EU-US Data Privacy Framework (where the provider is certified) or SCC 2021/914 Module 3 | Where the sending account is ours (otherwise see section 2) |
| OpenAI | USA | Guest AI assistant; drafting of replies to and translations of reviews; recognition of supplier invoices; transcription of procurement dictation | Text of the guest's conversation with the assistant, review texts, invoice images and text, audio recordings of procurement dictation | EU-US Data Privacy Framework (where the provider is certified) or SCC 2021/914 Module 3 | With the AI modules, only where the API key is ours (otherwise see section 2) |
| Anthropic PBC | USA | Daily analytics report for the owner and managers | Aggregated daily figures; reasons for cancellations, refunds and write-offs entered by staff, with email addresses, long digit sequences and street addresses replaced by labels before sending | EU-US Data Privacy Framework (where the provider is certified) or SCC 2021/914 Module 3 | With the analytics report, only where the API key is ours (otherwise see section 2) |
| Anthropic PBC | USA | AI assistant for development and technical support used by our staff | Fragments of logs, configuration and data of a deployment that our staff open to the tool when resolving incidents | EU-US Data Privacy Framework (where the provider is certified) or SCC 2021/914 Module 3 | Only where our staff give the tool access to the logs, configuration or database of a deployment |
| AlphaSMS (Ukraine) or Twilio Inc. (USA) | Ukraine / USA | SMS with one-time codes and notifications | Telephone number, SMS text | AlphaSMS: SCC 2021/914 Module 3 (Ukraine has no adequacy decision); Twilio: EU-US Data Privacy Framework (where the provider is certified) or SCC 2021/914 Module 3 | Where the SMS account is ours (otherwise see section 2) |
| Visicom | Ukraine | Geocoding and delivery address suggestions | Address text, coordinates | SCC 2021/914 Module 3 (Ukraine has no adequacy decision) | Delivery in Ukraine, where the API key is ours (otherwise see section 2) |
| Google (Google LLC / Google Ireland Limited) — Places API, Sign in with Google | USA / Ireland | Address and place search; sign-in with Google | Address queries; Google identifier, email address, profile name and photo | EU-US Data Privacy Framework (where the provider is certified) or SCC 2021/914 Module 3 | Where the API key and the OAuth client are ours (otherwise see section 2) |
| Telegram Messenger Inc. | Outside the EEA | Technical notification channel of our staff (errors and alerts of a deployment) | Technical error texts and alerts: internal record identifiers, time, amounts, request paths; email addresses, telephone and card numbers, IP addresses and chat identifiers are replaced with labels before sending; no names, delivery addresses or guests' messages | Telegram acts as an independent controller under its own terms; only the filtered technical data described here are sent | Always |
2. Vitrina Platform — Services Connected Under the Client's Own Contract
For information only. These services are not our sub-processors: the client (or its establishment) holds the contract and the account or key, and the Platform transfers data to them on the client's instructions. They are listed in Part B of Appendix IV of the client's Data Processing Agreement and in the client's own privacy notice. Only the services enabled in a given deployment are used.
| Service | Function | Note |
|---|---|---|
| LiqPay (JSC CB «PrivatBank»), Stripe, monobank, WayForPay | Online payment, card saving, refunds | The guest enters card details on the provider's page; the provider processes payment data as a controller under payment services law |
| Acquiring bank of the client — payment terminal | Card payment at the outlet | Card data are read by the terminal and are not received by the Platform |
| Checkbox, Nine Digit eKasa, fiskaly, efsta | Fiscalisation of payments (by country) | Receipt data are transmitted to the tax authority as required by law |
| AlphaSMS, Twilio | SMS with one-time codes and notifications | Where the SMS account belongs to the client |
| Visicom | Geocoding and delivery address suggestions | Where the API key belongs to the client |
| Google — Sign in with Google, Places API, Business Profile | Sign-in; public reviews and replies to them | Where the OAuth client and the API key belong to the client |
| Meta Platforms Ireland Limited | Sign in with Facebook | Where the Meta app belongs to the client |
| Apple (Apple Inc. / Apple Distribution International Ltd.) | Publication of the iOS app, push notifications to iOS devices, Sign in with Apple | Under the client's Apple Developer Program account, to which we have access within the role granted |
| Telegram Messenger Inc. | The client's bots: guest support, ordering, staff bots | Telegram acts as an independent controller under its own terms |
| OpenAI, Anthropic | AI modules (assistant, reviews, invoices, analytics report) | Where the API key belongs to the client — the default configuration of a deployment |
| Wolt Drive, Glovo On-Demand, Bolt Delivery | Delivery of the client's orders by the aggregator's couriers | The guest's name, telephone number, delivery address and coordinates are transferred |
| Glovo Partners, Wolt Merchant, Bolt Food | Receiving orders placed on marketplaces | Menu, prices, stop list and order statuses are sent; order data are received from the marketplace |
3. Custom Development Projects
Engaged on a per-project basis, only where a custom development engagement requires. The sub-processors actually used in a given project are documented in the Principal Agreement or Statement of Work. Clients may request alternative sub-processors or restrict transfers to specific regions during contract negotiation.
| Sub-processor | Location | Purpose | Personal Data Categories | Transfer Mechanism | When engaged |
|---|---|---|---|---|---|
| Amazon Web Services EMEA SARL | EU (eu-central-1 Frankfurt by default; other regions on request) | Cloud infrastructure, storage, compute | All client-defined data categories | EU controller; data residency in EU | Per project |
| Cloudflare, Inc. | Global edge network, EU regions prioritized | CDN, DDoS protection, edge compute | IP addresses, request metadata | SCC 2021/914 + EU-US DPF | Per project |
| Sentry (Functional Software, Inc.) | USA (with EU region available on request) | Error monitoring and performance tracking | Stack traces, IP addresses, user IDs | SCC 2021/914 + EU-US DPF | Per project |
| Neon Inc. / Railway Corp. | USA (with EU region) | Managed PostgreSQL hosting | All client-defined data categories | SCC 2021/914 | Per project |
| OpenAI Ireland Ltd. (EU entity) | EU (with US fallback) | LLM API for AI features | Prompt and response content as configured by client | EU controller relationship; SCC 2021/914 for US fallback | Per project |
| Anthropic PBC | USA (with EU data processing zone) | LLM API (Claude) for AI features | Prompt and response content as configured by client | SCC 2021/914 + EU-US DPF | Per project |
4. Our Own Website
For the website complete-solution.eu (analytics, hosting, contact forms and newsletter) Complete solution s. r. o. acts as controller, not as processor for clients. The services used there are described in our Privacy Policy.
Personnel
Client personal data are accessed only by personnel of Complete solution s. r. o. (Slovak Republic) who are bound by confidentiality obligations. Where personnel or sub-processors outside the EEA are engaged, this list is updated under the 30-day notice procedure and the transfer relies on Module 3 of the SCC 2021/914 supplemented by a transfer impact assessment, which is provided on request.