Sub-processors

Last updated 21 September 2026 · English is the governing language of this document.

The full list

These are every company that touches personal data on our behalf. There is no advertising network, no data broker and no analytics vendor on this list, because we do not use any.

Company	What it does	What it sees	Where
Cloudflare, Inc.	Website hosting, DNS, CDN, bot protection	Connection data: IP address, browser string, requested page	Global edge; US parent, under standard contractual clauses
Supabase	Database for orders, baskets and products	Order and customer data	Hosted in Frankfurt, Germany (EU)
Brevo (Sendinblue SAS)	Order emails and the harvest note	Name, email address, order summary	France (EU)
Viva.com	Card, wallet and local payment processing	Payment and billing data. Also a controller in its own right	Greece (EU)
Mollie B.V.	Alternative payment processing	Payment and billing data. Also a controller in its own right	Netherlands (EU)
Couriers	Delivering the parcel	Name, delivery address, phone number	Varies by destination; EU

Payment providers are not only our processors: as regulated institutions they are also controllers of payment data in their own right, and their own privacy notices apply to that part.

What is deliberately not here

Worth stating plainly, because most shops of this size use all of them:

No Google Analytics or any other third-party analytics.
No Meta pixel, no advertising or conversion tags.
No Google Fonts. Our typefaces are served from our own domain.
No embedded maps, videos or social widgets.
No customer-support chat widget.
No CRM or marketing automation platform.

Changes to this list

If we add a sub-processor we will update this page before it starts processing anything. If you have a standing objection to a particular provider, tell us at our contact form.