Sub-processors
DRAFT — under review, version 2026-09-25. Annex 2 to the data processing agreement. Entries marked "to be confirmed" have not yet been checked against the provider's own paperwork.
These are the services Motif Labs uses that receive personal data of your buyers — name, company, address, phone, email, and what was shipped — when you use the shipping portal.
| Sub-processor | Purpose | Data it receives | Location |
|---|
| Sliplane | hosts the portal and its storage | all portal data | Germany (EU region Frankfurt) |
| Cloudflare, Inc. — R2 object storage | off-site copy of the nightly backup | all portal data, encrypted before upload; Cloudflare cannot read it | stored in Western Europe; Cloudflare is a US company |
| Paket International (weltweitversenden GmbH) | label broker: books the label with the carrier | recipient name, company, address, phone, email, parcel weight, contents and declared value | Germany (to be confirmed) |
| OpenStreetMap Foundation — Nominatim | checks whether a postcode is in a carrier's remote-area zone | country and postcode only — never a name or street | United Kingdom (to be confirmed) |
Carriers
The label for each parcel is booked with one of the carriers below, whichever wins the rate comparison. The carrier receives the recipient's name, company, address, phone and email, plus parcel details and, for parcels leaving the EU, the customs data. Once a parcel is booked, the carrier acts as a controller in its own right for the delivery (DPA §5).
| Carrier | Location |
|---|
| DHL (Deutsche Post / DHL Paket) | Germany |
| UPS | EU entity to be confirmed; parent company in the United States |
| FedEx | EU entity to be confirmed; parent company in the United States |
| GLS | EU entity to be confirmed |
| DPD | EU entity to be confirmed |
| Austrian Post (Österreichische Post) | Austria |
Not used for your buyers' data
- Google and GitHub handle sign-in for people who use the portal. They receive the user's email address, never buyer data. See the privacy notice.
- Google Fonts serves the portal's typeface; the user's browser shares its IP address when a page loads. No buyer data.
- AI address and invoice reading is switched off for organisations using the portal, so no buyer data reaches it.
- Services Motif Labs uses for its own bookkeeping, banking and shops receive no data from your organisation.
Changes to this list
We give 30 days' notice before a new sub-processor receives your data, and you may object (DPA §5).