Shipvise
EN
Sign in Try Shipvise

Shipvise subprocessors and related providers

Version: 1.0
Effective: upon publication of this version
Last updated: 21 August 2026
Stable URL: https://shipvise.com/en/legal/subprocessors/

Translation notice: This English version is a machine-assisted translation provided for convenience. The original Czech version is the authoritative version. Where mandatory law requires otherwise, rights granted by mandatory law remain unaffected.

This overview distinguishes subprocessors of Customer personal data, which Shipvise engages as a processor under the DPA, from other providers that may have a role of their own.

1. Active subprocessor of hosted Customer data

WEDOS Internet, a.s.

  • Provider: WEDOS Internet, a.s.
  • Company ID: 28115708
  • Registered office: Masarykova 1230, 562 01 Ústí nad Orlicí, Czech Republic
  • Purpose: VPS/infrastructure and related hosting services on which parts of Shipvise are operated.
  • Data typically concerned: hosted Customer data, source/artifacts and platform/operational metadata to the extent stored on the infrastructure.
  • Region: Czech Republic / EU, depending on the specific service.
  • Role: to the relevant extent, another processor of Customer data.

2. Provider-operated Shipvise infrastructure — not an external subprocessor

In the MVP, the following components are operated directly by the Provider and are not a separate external legal entity engaged as a subprocessor:

  • the Provider's own e-mail infrastructure;
  • the managed Git service;
  • the OCI registry;
  • internal website analytics;
  • self-hosted ALTCHA;
  • internal object/storage layers within the infrastructure;
  • operational backup copies on the Provider's own NAS infrastructure, transferred over a secured private link.

This does not exclude the fact that the physical VPS infrastructure uses WEDOS as the external provider identified above.

3. Payment providers — Comgate and PayPal

ComGate Payments, a.s. is the primary payment provider. PayPal may be offered as an alternative payment provider, including for markets or transactions not supported by the current Comgate configuration. The availability of each provider and payment method depends on the country, currency, transaction type and the current checkout configuration.

Neither Comgate nor PayPal is designated in this list as a subprocessor of hosted Customer application data, because their role is a payment role. Payment data may be passed to them to the extent necessary to carry out the payment, a refund, fraud prevention and compliance with statutory obligations. Within payment services they may act as independent controllers under their own regulatory obligations; PayPal acts as an independent controller for payment services.

The current privacy information of Comgate and PayPal is governed by their own documentation.

4. Customer-selected external Git

Where the Customer connects GitHub or another supported external Git provider themselves, this is an integration chosen by the Customer.

Such a provider is not automatically a subprocessor engaged by Shipvise for managed hosting of data. The Customer is responsible for their own relationship with that provider and for its configuration, unless Shipvise later expressly offers the integration in a different legal role.

5. External generative AI

In the MVP, no external generative AI provider is approved as a subprocessor of Customer source code, secrets or hosted personal data.

Shipvise does not send such content to external generative AI services as part of ordinary hosting or Senior Review.

Before adding such a subprocessor in the future, the Provider will carry out a vendor/privacy review and update this list and the DPA.

6. Notice of changes

For Customers to whom the DPA applies, the Provider will give notice of a planned addition or replacement of a significant subprocessor, as a standard, at least 14 days in advance, unless an urgent security or legal circumstance objectively requires a faster change.

Reasoned objections on data protection grounds can be sent to privacy@shipvise.com.

7. International transfers

Should a new subprocessor process personal data outside the EEA, the Provider will, before the processing begins, assess and document an appropriate mechanism under Chapter V of the GDPR, for example an adequacy decision or standard contractual clauses together with the necessary supplementary measures.