Annex 2 to the Data Processing Agreement (DPA) – Stockaro
Last updated: 2026-08-12
This is a translation provided for your convenience. The German version is the authoritative one; in the event of any discrepancy, the German text prevails.
Changes to this list are communicated to the merchant at least 30 days before they take effect, by email or in-app notification. The merchant may object in writing within 30 days. In the event of an objection, the merchant may terminate the service.
| Provider | Railway Corp. |
| Address | 340 S Lemon Ave #4133, Walnut, CA 91789, USA |
| Purpose | Cloud hosting of the app, PostgreSQL database, environment variables/secrets |
| Data processed | All app data (shop data, order data, inventory data, support and feedback data) |
| Region | EU-West (Amsterdam, Netherlands) |
| Certifications | SOC 2 Type II |
| Transfer basis | Hosting of application and database data takes place in the region EU-West (Amsterdam, Netherlands) within the EU/EEA; no third-country transfer is envisaged for hosting. Contractual basis: Railway DPA |
Relevant for transactional emails to merchants (e.g. weekly reports, low-stock alerts) and internal support ticket notifications.
| Provider | Resend, Inc. |
| Address | 185 Berry Street, Suite 550, San Francisco, CA 94107, USA |
| Purpose | Transactional emails to merchants and internal support ticket notifications |
| Data processed | Merchant email address, shop domain, SKU information in stock notifications, and support ticket content (subject, message, technical context and optionally shortened error-log excerpts) |
| Region | USA |
| Transfer basis | EU Standard Contractual Clauses (SCC) pursuant to the Resend DPA |
Back to the Data Processing Agreement | Technical and organisational measures | Privacy policy | Help