Subprocessors
The third parties Anmelda uses to deliver the service, what each one receives, and where it processes data. This list is referenced by the Data Processing Agreement. We notify merchants before adding or replacing a subprocessor.
Last updated: 17 July 2026
Infrastructure
| Subprocessor | Purpose | Data received | Location |
|---|---|---|---|
| Amazon Web Services AWS EMEA SARL, Luxembourg |
Hosting, database, encrypted backups, and outbound email (Amazon SES) | All application data, including applicant personal data; applicant email address and decision email content | eu-central-1 (Frankfurt, Germany) |
| Shopify Shopify International Ltd., Ireland |
The platform the app runs on; receives the B2B company created on approval | Company name, location address, contact name and email of approved applicants; verification results written to company metafields | Per Shopify's own terms |
There is one infrastructure subprocessor, not two. Decision emails are sent with Amazon SES in the same Frankfurt region as the database, so an applicant's email address never leaves eu-central-1 on its way to them. We previously planned to use a US email provider and chose not to: their regional setting moves only where mail is dispatched from, while the metadata and logs — which is to say, the list of who applied where — stay in the United States. No subprocessor processes applicant data outside the EEA.
Separately from the subprocessors above, Anmelda itself is operated from Switzerland, so the data is available to us there when we administer the service — a transfer to a third country under GDPR Chapter V, whatever region the servers are in. Switzerland holds a European Commission adequacy decision, which is that transfer's legal basis. No applicant data reaches a country without an adequacy decision. See the Privacy Policy.
Business registries
Registries are queried to verify a business. They are independent public authorities, not our processors — we send a lookup and they answer. We send only the company identifier. No applicant name, address, phone or email is ever transmitted to a registry.
| Registry | Operated by | Data sent |
|---|---|---|
| VIES EU VAT validation |
European Commission | Country code and VAT number only |
| Zefix Swiss commercial register |
Swiss Federal Office of Justice | Swiss UID only |
| Companies House UK company register |
UK Companies House | Company registration number only |
A company identifier can still be personal data. A sole trader's VAT number identifies a person, so we treat registry lookups and their results as personal data throughout — including at erasure, where the record is deleted rather than anonymised.
What we do not use
Anmelda runs no analytics, no advertising or tracking pixels, and no third-party scripts on the merchant's storefront or in this website. The application form and the admin interface set no tracking cookies. This site stores a single value in your browser (an_lang_dismiss) to remember that you dismissed the language suggestion; it never leaves your device and identifies no one.