Sub-processors and Third-Party Recipients

Pircel binds each sub-processor by written data protection terms at least as protective as those it owes its Customers under the Data Processing Agreement, and stays liable to the Customer for each one.

Some sub-processors rely on further providers of their own (for example, Amazon Web Services underlies MongoDB Atlas and Heroku). The list above names the parties Pircel contracts with directly. More detail is in each provider's published documentation, and from us on request.

The following third parties receive personal data through the Service as independent data controllers, not as Pircel's sub-processors.

Couriers

When a shipment is booked, the recipient's details (name, postal address, phone and email where given) and the shipment's details (such as the cash-on-delivery amount and the parcels) go to the courier chosen for it. Couriers receive this data as independent controllers for the delivery. They process it for their own purposes, keep it under their own retention rules and statutory duties, and publish their own privacy notices.

FedEx and UPS:

• for rate quotes, they receive no street, name or contact details, only what's needed to price the parcel, such as the postcode, town, region and country;
• for bookings, through the Customer's own account: FedEx through its Greek company, and UPS through UPS of Greece, Inc., a US company with a branch in Greece. The Customer is the controller and exporter of what it discloses (Data Processing Agreement, clause 9), and each courier may transfer data onward under its own arrangements.

Pircel doesn't control the couriers' security practices, retention periods or onward disclosures.

Google Maps Platform

Google LLC (Google Maps Platform: the Geocoding, Address Validation and Places APIs), for address checks and lookups: an independent controller under its Maps Platform terms (EEA Terms of Service §4.5; Controller-Controller Data Protection Terms §4.1(a)). United States, on Google's own Data Privacy Framework certification and the Standard Contractual Clauses in its controller terms.

The following systems are run by, or for, our Customers. The Customer starts the data flows between them and the Service, as the data controller. We don't list them as sub-processors because we don't engage them; the Customer does.

When the Customer connects one of these platforms, the Service exchanges data with it under the Customer's authorisation, for example to read product data and receive orders. The Customer is the controller of the data held in that platform.

The following third parties are linked from the website. We don't send them personal data; if you follow a link, your use of their service is governed by their own privacy notices.

We don't embed these services as frames or scripts; they're plain links.

• Pircel gives as much notice as it receives of an added or replaced sub-processor, and at least 30 days where its own agreements allow. It updates this page, as a new dated version, and emails every Customer's account contact.
• A Customer may object on reasonable data protection grounds within the notice period, as clause 6 of the Data Processing Agreement sets out.
• Every version of this page is kept unchanged at its own address.

Questions about this page, our sub-processors, or any data processing described here: Pircel P.C., 32 Voukourestiou Street, 106 71 Athens, Greece; privacy@pircel.com.