Subprocessors — Delivery Zone

Version: 1.5

Last updated: 2026-08-31

Delivery Zone uses the following third-party providers to operate the service. The providers listed under "Current subprocessors" may process personal data on our behalf where necessary to provide, secure, support, or bill for the service.

We will notify registered account holders and update this page at least 30 days before adding or replacing a subprocessor that processes personal data on our behalf.

---

Current subprocessors

Cloudflare, Inc.

Purpose: Application hosting (our API and dashboard run on Cloudflare Workers), CDN, edge security, and object storage for postcode datasets and invoice files.
Region: Global edge network.
Privacy information: cloudflare.com/privacypolicy

---

Scaleway SAS

Purpose: Managed database hosting, key management for encryption of sensitive account data, and transactional email delivery.
Region: European Union (database and key management in the Netherlands; email delivery in France).
Privacy information: scaleway.com/en/privacy

---

Independent controllers and payment providers

The provider below is not listed as a GDPR Article 28 subprocessor. Based on Mollie's

published merchant terms, Mollie B.V. and GN-Projects Solutions Oy generally act as

independent data controllers, not in a controller-processor relationship, for payment

processing carried out under the Mollie merchant User Agreement. Mollie is responsible for its

own processing of your payment data under its own privacy notice.

Mollie B.V.

Purpose: Payment processing, subscription management, invoicing, and payment-related customer support.
Role: Independent data controller for payment processing (not a Delivery Zone Article 28 subprocessor), based on Mollie's published merchant terms.
Privacy information: mollie.com/privacy

---

Data suppliers that are not subprocessors

Posti Group Oyj

Purpose: Authoritative source of current Finnish postcode existence, validity, and type information.
Status: Reference-data source only. Posti does not process Delivery Zone customer personal data on our behalf, does not endorse or certify Delivery Zone, and has not licensed Delivery Zone.

Licensed third-party coordinate fallback provider

Purpose: Temporary licensed coordinate source used for radius (distance-based) delivery rules where Delivery Zone's own geospatial dataset does not yet meet our production confidence threshold for a given postcode.
Status: Data supplier/licensor only. This provider does not process Delivery Zone customer personal data on our behalf.
Note: We do not sell, publish, sublicense, redistribute, or provide direct access to the underlying dataset. The exact vendor and licence details are documented internally and are not disclosed on this public page.

Open geospatial reference sources

Delivery Zone's own versioned geospatial dataset is built in part from open geographic reference

sources, including OpenStreetMap contributors, Statistics Finland (Paavo), and other Finnish

official geographic data. None of these sources process Delivery Zone customer personal data on

our behalf. See Data Sources & Attribution for full attribution.

---

Changes to this list

We will email registered account owners and update this page at least 30 days before adding or replacing a subprocessor that processes personal data on our behalf.

To object to a new subprocessor, contact [email protected].

For DPA enquiries: [email protected]