Authorized Sub-processors
Last updated: April 16, 2026
This page lists the Sub-processors that SearchX (CommerceX PC) uses to process customer data. This list is maintained in accordance with our Data Processing Addendum (DPA).
SearchX notifies customers of any intended changes concerning the addition or replacement of Sub-processors at least thirty (30) days in advance, giving customers the opportunity to object to such changes in accordance with Section 5 of the DPA.
Current Sub-processors
The following Sub-processors are authorized to process Personal Data on behalf of SearchX customers:
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Hetzner | Infrastructure and hosting | All application data | Germany (EU) |
| OpenAI | AI-powered semantic search features | Search queries, product data (as configured by customer) | United States (with SCCs) |
| Elorus | Accounting, invoicing, myDATA compliance | Customer name, email, VAT number, billing address, invoice amounts | Greece (EU) |
| Brevo | Transactional emails (OTP codes, notifications, reports) | User email addresses, names | EU |
| Stripe | Payment processing and billing | Customer billing details, payment card tokens, invoice data | EU and USA (with SCCs) |
| Cloudflare | Content delivery network (CDN) and security services | IP addresses, request metadata | EU and USA (with SCCs) |
| Google Analytics | Website analytics and usage tracking | Anonymized usage data, page views | USA (with SCCs) |
International Data Transfers
Where a Sub-processor is located outside the European Economic Area (EEA) or processes data in a country that has not received an adequacy decision from the European Commission, SearchX ensures appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) as indicated in the table above.
Changes to Sub-processors
SearchX will notify customers via email at least thirty (30) days before adding or replacing any Sub-processor. Customers may object to a new Sub-processor on reasonable grounds relating to data protection as outlined in the DPA.
Contact
For questions regarding our Sub-processors or to object to a new Sub-processor, please contact us at [email protected].