Flowbity sp. z o.o. uses the providers below to deliver the Servavio service (Article 28(2) GDPR). Each of them processes data only to the extent needed for the stated purpose, under the data processing terms published by that provider (linked in the table).
| Provider | Purpose | Data | Place of processing | Transfer basis |
|---|---|---|---|---|
| netcup GmbH (Karlsruhe, Germany) | Application server: application, database, photo files, logs | all data processed in the service | Germany (Nuremberg data centre) | EEA, no transfer outside the EEA |
| Google Cloud EMEA Limited (Dublin, Ireland) - Vertex AI (Gemini) | Recognising parts, reading labels from photos (OCR), proposing categories, parameters, matching vehicles and descriptions; some requests use Google Search | photos of parts and labels, text read from labels, part numbers, seller notes, offer data, Google Search queries built from them (grounding) | Google Cloud global endpoint; processing outside the EEA is possible, including in the USA | Standard Contractual Clauses (SCC) in the Cloud Data Processing Addendum |
| Plus Five Five, Inc. (USA) - Resend | Sending e-mail (address confirmation, password reset, invitations, notices) | e-mail addresses, message content | USA | Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework, resend.com/legal/dpa |
| Fakturownia sp. z o.o. (Warsaw, Poland) | Issuing VAT invoices and submitting them to KSeF | company name, address, tax ID, amounts | Poland | EEA, no transfer outside the EEA |
| Stripe Payments Europe, Limited (Dublin, Ireland) only once online payments are launched; not used at present |
Card payments and subscriptions | e-mail address, tax ID, payment data | EU and USA | EU-US Data Privacy Framework and SCC, stripe.com/legal/dpa |
Database backups and the photo archive are kept on Flowbity sp. z o.o.'s own device in Poland. Logs and monitoring run on the same server as the application. Visit statistics are kept by Umami installed on our own server (no cookies, no data passed to third parties); we use no external analytics tools and no external error-tracking system. Last updated: 6 October 2026.
To external part catalogues (including eBay and part manufacturers' catalogues) we send part numbers only, without personal data.
We give notice of an intended addition or change of a sub-processor by e-mail or by a message in the service at least 30 days in advance. Within that time a customer may object under the rules described in the DPA.