Providers and sub-processors

Last updated: 23 September 2026.

To provide its services, SendingBay relies on external providers that may process personal data on behalf of its customers. This page sets out who they are, what they are used for and what data each of them receives.

This list forms part of the Data Processing Agreement that accompanies the terms of service. All providers are bound by data protection obligations equivalent to those SendingBay assumes towards its customers, and the customer may object on reasonable grounds to the addition or replacement of any of them.

Providers that process data on behalf of the customer

These are the sub-processors in the strict sense: they process the information the customer manages through the platform.

Infrastructure and hosting

Google Cloud Platform: Hosting and databases. Data centres located in the European Economic Area.

IONOS: Hosting and databases. Data centres located in the European Union.

Microsoft Azure: Hosting and databases. Data centres located in the European Economic Area.

Box: File storage, always encrypted.

Addresses and mapping

Google Maps Platform: Conversion of postal addresses into geographic coordinates. It receives only the address, postcode, town and country. It does not receive the recipient's name, telephone or email address.

Google Vertex AI: Artificial intelligence platform used in various processes, including the interpretation of incomplete or misspelt addresses when geolocation cannot be resolved automatically. It receives only the data strictly necessary for each process and, in the case of addresses, no data identifying the recipient. SendingBay selects at any given time the most suitable model within this platform, which does not entail adding a different provider. Processing within the European Union.

CARTO: Cartographic rendering of the maps shown in the application. It receives no shipment or personal data.

Base cartography comes from OpenStreetMap, an open project. Road navigation is carried out by each user in the application of their choice, outside SendingBay's systems.

Route calculation

Google Route Optimization: Calculation and optimisation of delivery routes in the modes that use it. It receives only geographic coordinates and a technical service identifier, together with operational data such as weight, volume or time slot. It does not receive the address in text form or any data identifying the recipient.

Data minimisation

SendingBay's systems are designed to send these providers the minimum data necessary. In route calculation only coordinates and a technical identifier travel: the recipient's name, telephone and email are never communicated.

Customer support channels

When a customer requests support, the information provided may contain personal data: screenshots of shipments, references, addresses or recipients' contact details. That information is processed in SendingBay's support and internal management tools, hosted on the infrastructure indicated above, for the sole purpose of resolving the issue.

Telephone switchboard: Handling of support calls. Calls may be recorded and transcribed for the follow-up and resolution of issues.

We recommend that our customers provide only the information needed to resolve each query.

Carrier networks

When the customer transmits a shipment to a carrier network, the data needed for delivery is communicated to the network the customer has chosen. Those networks act as independent controllers of the information they receive, under their own terms and obligations.

Other recipients

The following providers do not process the data the customer manages on the platform, but only the data of the contractual and billing relationship between SendingBay and the customer (company name, tax identification, contact and payment details). They are listed for transparency:

Banks: Management of SEPA direct debits.

Stripe: Processing of card payments.

Tax and accounting advisers: Fulfilment of SendingBay's accounting and tax obligations.

These entities act as independent controllers or in fulfilment of their own legal obligations, and therefore are not part of the list of sub-processors.

Where data is processed

As a general rule, processing takes place in data centres located in the European Economic Area. Some global services may occasionally process information outside it; in such cases, processing is covered by the standard contractual clauses approved by the European Commission, signed with the relevant provider.

Artificial intelligence

Some features rely on artificial intelligence services from the providers listed above. SendingBay selects at any given time the most suitable model within the provider's platform, depending on the process concerned.

Data is not used to train the provider's models, in accordance with the contractual terms agreed with it.

The platform does not make automated decisions without human intervention that produce legal effects on individuals: the proposals it generates, such as the order of a route, are always subject to the customer's validation.

In-house engine

Route grouping and optimisation runs on SendingBay's own infrastructure. Those processes do not communicate data to third parties.

Changes to this list

SendingBay will give reasonable notice of any addition or replacement of providers. The customer may object on well-founded and reasonable grounds relating to data protection. In that case, the parties will seek an alternative solution and, failing that, the customer may terminate the contract without penalty.

Contact

For any enquiry about this list of providers: admin@sendingbay.com.