shippp

Data Processing Agreement (DPA)

Last updated: 1 July 2026

This DPA forms part of the agreement between the customer (workspace owner, the “Controller”) and Shippp (the “Processor”) and governs Shippp’s processing of personal data on the Controller’s behalf under Art. 28 GDPR.

1. Parties & roles

Processor: Dipatch Bt. — see the Legal Notice.

For workspace content that the Controller and its members create, Shippp acts as Processor and processes personal data only on the Controller’s documented instructions. For account, authentication and billing data, Shippp acts as an independent controller (see the Privacy Notice).

2. Subject-matter, duration, nature & purpose

  • Subject-matter: provision of the Shippp design-to-code service.
  • Duration: for the term of the subscription plus statutory retention periods.
  • Nature & purpose: hosting, storing, transmitting and processing workspace content to provide the Service and its features.
  • Types of personal data: account identifiers, names, emails, and any personal data the Controller places in workspace content.
  • Categories of data subjects: the Controller’s users, workspace members and their contacts.

3. Processor obligations (Art. 28)

  • Process personal data only on the Controller’s documented instructions.
  • Ensure persons authorised to process are under a duty of confidentiality.
  • Implement appropriate technical and organisational security measures (Art. 32).
  • Assist the Controller with data-subject requests and with Arts. 32–36 obligations.
  • Notify the Controller without undue delay after becoming aware of a personal-data breach.
  • At the Controller’s choice, delete or return personal data at the end of the service, subject to legal retention.
  • Make available information necessary to demonstrate compliance and allow audits.

4. Sub-processors

The Controller authorises Shippp to engage the sub-processors listed below. Shippp imposes data-protection obligations on each sub-processor no less protective than this DPA and remains liable for their performance. Shippp will inform the Controller of intended changes and give an opportunity to object.

Recipient / processorPurposeLocationTransfer safeguard
Stripe (Stripe Payments Europe, Ltd.)Payment processing & subscription billingIreland / United StatesSCCs / EU-US Data Privacy Framework
Neon, Inc.Managed Postgres database hostingEU region / United StatesSCCs
Resend (Plus Five Five, Inc.)Transactional & marketing email deliveryUnited StatesSCCs
Cloudflare, Inc. (PartyKit)Realtime collaboration infrastructureUnited States / global edgeSCCs
Cloudflare R2Asset / file storageEU / globalSCCs
KBOSS.hu Kft. (e-invoicing provider)Invoice issuance & Hungarian Tax Authority (NAV) reportingHungary (EU)Within the EU
Google Ireland Ltd. (Google Analytics)Website analytics (consent-gated)EU / United StatesSCCs / EU-US Data Privacy Framework
Vercel, Inc.Application & website hostingUnited States / global edgeSCCs / EU-US Data Privacy Framework
OpenAI, Anthropic, Google, xAI, DeepSeek, OpenRouter (AI providers, BYOK)AI-assisted canvas features — receive user/workspace content when AI is used with your own API keyUnited States (DeepSeek: China) / globalInternational transfer; under BYOK the controller for the provider relationship may be you (the user)

Note on AI providers (BYOK): when the Controller or its members use AI features with their own provider API key, workspace content is sent to the selected AI provider (OpenAI, Anthropic, Google, xAI, DeepSeek or OpenRouter). Because this runs on the Controller’s own key/account, the provider relationship’s controller may be the Controller; the Controller is responsible for that provider’s terms and any transfer. If AI egress is disabled, no such processing occurs.

5. International transfers

Where a sub-processor is outside the EEA, transfers rely on an adequacy decision or the Standard Contractual Clauses with supplementary measures, as reflected in the table above.

6. Security, audits, liability

Shippp maintains measures appropriate to the risk (Art. 32). The Controller may request information and audits on reasonable notice. Liability follows the main agreement and applicable law. This DPA prevails over conflicting terms of the main agreement with respect to processing of personal data.