Subprocessors

Purpose and scope

A subprocessor is generally a service provider engaged by a processor to process personal data on behalf of a customer. Whether a particular organisation is a subprocessor depends on the parties’ roles, instructions, data flow, and written terms—not simply on whether its technology appears in a service journey.

When a provider is a subprocessor

Gerai considers whether a provider receives or can access personal data, whose instructions govern the processing, why the data is processed, and whether the provider acts for Gerai or in another capacity.

Organisations in a Gerai-related journey may instead be:

• a service selected and contracted directly by the merchant;
• an independent controller determining its own purposes and obligations;
• a licensed payment gateway handling payment credentials under its own terms; or
• a provider that does not process customer personal data for the relevant service scope.

For example, a licensed payment gateway’s role must be assessed separately. Gerai does not hold buyer funds, and settlement is made directly from the gateway to the merchant. That payment boundary does not, by itself, determine the gateway’s privacy-law classification.

Customer-specific disclosure

Before onboarding where subprocessor information is required, Gerai can prepare or agree a customer-specific schedule based on the service being purchased and the data expected to be processed. A useful disclosure records the following information where applicable and verified:

Contracting process

Where Gerai engages a provider to process customer personal data on Gerai’s behalf, the intended process is to align the provider’s permitted processing with the service scope and the obligations Gerai has accepted in writing. Depending on the engagement and applicable law, written terms may address:

• documented processing purposes and instructions;
• confidentiality and access restrictions;
• security obligations appropriate to the processing;
• assistance with incidents, rights requests, deletion, or return of data;
• limits on further subcontracting; and
• lawful transfer mechanisms where cross-border processing requires them.

The exact terms depend on the customer contract, provider agreement, applicable law, and verified data flow. See the Data Processing Addendum page for Gerai’s customer contracting route.

Changes and concerns

Notice, approval, and objection rights are governed by the applicable written agreement. Gerai does not publish a universal notice period or automatic objection right that applies to every customer regardless of contract or law.

Where an agreement requires notice of a relevant change, the notice can identify the provider, purpose, affected processing, effective date, and method for raising a contractual concern. Gerai and the customer can then consider the concern under their agreed process, including feasible changes to scope or configuration where available.

Request information

To request a subprocessor schedule or discuss contractual requirements, email hello@gerai.shop before onboarding. Include the proposed service scope, relevant jurisdictions, data categories, and any required location or notice terms.

Related information is available in the Privacy Policy and Data Residency page.