Subprocessors

1. Subprocessor categories

A provider is only involved when you use the related feature. For example, if you do not send SMS or WhatsApp messages, no phone numbers go to the messaging infrastructure.

Contracted producers are independent print businesses operating in the United States. Custombull is not a manufacturer; your order is routed to a suitable producer in the network based on the product and location. Producers see only the data needed to print, pack and ship that order.

2. Full list with names

The full current list of subprocessors, with their names, is provided to Custombull customers on request under a duty of confidentiality at hello@custombull.com; customers are notified at least 30 days before a new subprocessor is added and have the right to object.

This approach meets the notice requirements on "recipients or categories of recipients" in GDPR Articles 13(1)(e) and 14(1)(e) and on "to whom personal data may be transferred" in Article 10 of Türkiye's KVKK. Under the Data Processing Agreement, our customers keep the right to know subprocessors by name and to object.

3. Parties that are not subprocessors

We exchange data with the following parties, but they do not act on our behalf; their own terms and privacy policies apply:

• Marketplaces and store platforms you connect (Etsy, Shopify, eBay, Amazon and other channels in early access): we read and write listing and order data with the access you grant.
• "Sign in with Google": only if you use it, we receive your name, email address and profile ID from Google.
• Card networks and banks: they process your payment under their own rules.
• Public authorities: only in response to a binding legal request and to the extent the law allows.

4. Change notice and objection

At least 30 days before we add a new subprocessor or materially change the data an existing one processes, we notify our customers by email and, where needed, update the categories on this page. If an urgent security or continuity reason forces a shorter timeline, we notify you promptly with the reason.

If you wish to object on reasonable data protection grounds, email hello@custombull.com within 30 days of the notice. We will look for a solution together; if none is found, you may terminate the affected service and receive a refund of prepaid fees for the unused period. Details are in the Data Processing Agreement.

5. International transfer safeguards

Our application servers are in the European Union; most subprocessors process data in the United States. For transfers from the European Economic Area, the United Kingdom and Switzerland we rely on the European Commission's Standard Contractual Clauses (with the required UK and Swiss addenda). Transfers from Türkiye follow the mechanisms in Article 9 of the KVKK. See the Privacy Policy for details.