GDPR-compliant. By design, not by declaration.
We don't tick a box; the platform's architecture starts from data isolation. The full list of sub-processors and the data location is public.
Principles
Where the data lives
Servers, databases and files are hosted by DigitalOcean in London. The UK has a European Commission adequacy decision, so the data is protected to a standard equivalent to the EU. Primary backups are in Frankfurt. For providers with access from the US, we rely on the Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework.
Per-tenant isolation
Each client has its own MySQL database. On deletion: DROP DATABASE, not a query. Impossible to accidentally mix data.
Clear retention
Active data: for the duration of the contract. Invoices: 10 years (tax law). Logs: 90 days. On termination: 30-day grace period, then permanent deletion.
Standard DPA
We have a ready-to-sign DPA (Data Processing Agreement) available on request. Minor changes accepted; substantial changes discussed.
Sub-processors
These are the providers we use to run the platform that may have access to personal data. Each processes data only for the stated purpose, under a DPA compliant with GDPR Art. 28.
| Name | Purpose | Location | Safeguards |
|---|---|---|---|
| DigitalOcean | Servers, MySQL databases and file storage (Spaces) | United Kingdom (London); backups in Germany (Frankfurt) | DPA; EU adequacy decision for the UK |
| Resend | Emails sent by the platform (notifications, password resets) | EU (Ireland) | DPA; SCC and EU-US Data Privacy Framework |
| Google (Google Drive) | Off-site database backups | US and EU | DPA; SCC and EU-US Data Privacy Framework |
| Dropbox | Additional backup copy for accounts migrated from the previous version | US | DPA; SCC and EU-US Data Privacy Framework |
| Stripe | notsowms subscription payments (your billing data, not your customers' data) | EU (Ireland) | DPA; SCC and EU-US Data Privacy Framework |
List last updated: 27 October 2026.
When the list changes
Before we add or replace a sub-processor, we notify you by email, at your account address, at least 30 days in advance. During that period you may object on data protection grounds by writing to hello@notsowms.ro. If we cannot find a solution together, you may terminate the contract before the change takes effect.
Integrations you activate
The couriers, marketplaces and invoicing tools below are not our sub-processors. You choose them and you have a direct contract with them. notsowms sends them data only after you activate the integration, and only for the operation you request: a shipping label, an order sync or an invoice.
Couriers
Sameday, Cargus, FAN Courier, DPD, GLS, Pall-Ex
Marketplaces
eMAG Marketplace, Shopify, Wix, PrestaShop, OpenCart, MerchantPro, WooCommerce
Invoicing
SmartBill, Oblio, Sedona Cloud
DPA (Data Processing Agreement)
For any client that needs a signed DPA (which means: almost everyone), we have a standard one ready to sign. Based on the EU SCCs and aligned with GDPR Art. 28.
Data subject rights
Anyone whose data is processed in notsowms (you, your employees, or your end customers) has the rights provided by the GDPR: access, rectification, erasure, restriction, portability, objection.
Requests are sent to hello@notsowms.ro. We respond within 30 days at most (a legal requirement), usually much sooner.