Legal document
List of Subprocessors - Hiram Trade
- Version
- 2026-10-31
- In force from
- October 31, 2026
- Operator
- JIII-LEGACY
Version: 2026-10-31. Effective date: 2026-10-31.
Changes compared with version 2026-10-09: added Meta Platforms Ireland Limited as an independent controller (not a processor) for advertising measurement with the Meta pixel on public pages, used only with consent to the "Marketing" category; corrected the statement that the Operator uses no advertising tools.
Changes in version 2026-10-09 compared with version 2026-10-07: (1) the scope of the Microsoft Clarity tool also covers the pages of the listing wizard without an account on app.hiramtrade.com (/start); no processor was added for this reason, and the change applies from the effective date of this version; (2) the Microsoft Ireland Operations Limited row now covers the purpose "machine translation of listing and message text on request (Azure AI Translator)", region Germany West Central (Germany); point 3.3 (artificial intelligence) amended. Change (2) is announced at least 15 days ahead: Microsoft processes data for translation from the moment the translation feature is switched on, no earlier than 15 days after the announcement of 2026-10-09, and until then the feature remains switched off. Version 2026-10-07 applied up to and including 2026-10-08.
This English version is a translation. The Polish version is legally binding.
JIII-LEGACY (the "Operator") uses the providers below, to which it entrusts the processing of personal data under agreements compliant with Art. 28 GDPR (usually data processing agreements - DPAs - made available by the provider as part of its service terms). We give notice of changes to this list by publishing the updated version on the Platform; changes take effect upon publication, and the current version, with its version date, is always available.
1. Processors
| Provider | Service and purpose | Data categories | Processing location | Transfer mechanism outside the EEA |
|---|---|---|---|---|
| Cloudflare, Inc. (USA) | Hosting of the web application (Workers), container for the API and background processes (Containers), content delivery network, attack protection, DNS, technical logs; once file uploads are launched, file storage (R2) | all HTTP traffic, including IP address, cookies, request and response content; data processed in memory by the application | Cloudflare's global data centre network, including outside the EEA; the container location is chosen by Cloudflare | EU-US Data Privacy Framework (Cloudflare, Inc. is certified) and standard contractual clauses (Commission Implementing Decision (EU) 2021/914) in Cloudflare's DPA |
| Supabase, Inc. (USA) | Managed PostgreSQL database (all Platform data), backups | all data categories described in the Privacy Policy | EU - AWS region eu-central-1 (Frankfurt am Main); Amazon Web Services infrastructure as Supabase's subprocessor | standard contractual clauses in Supabase's DPA, for access from the USA (support, administration) |
| Upstash, Inc. (USA) | Redis cache: event and background job queue, rate-limiting counters | event and object identifiers, IP addresses in counters (short-lived), queue event content (may include User and Company identifiers) | EU - region eu-central-1 (Frankfurt am Main) | standard contractual clauses in Upstash's DPA, for access from the USA |
| Microsoft Ireland Operations Limited (Ireland); Microsoft Corporation (USA) | (1) Microsoft Clarity: session recordings and heatmaps of the public pages of hiramtrade.com and of the listing wizard without an account on app.hiramtrade.com (/start), visitor behaviour analytics; started only after consent to the "Analytics" category, does not run in the signed-in application. (2) From the moment the feature is switched on: machine translation of listing and message text on request (Azure AI Translator): text sent only after "Translate" is clicked, after contact data is masked and numbers, prices, codes and identifiers are protected; according to Microsoft's documentation the text is not stored after processing or used to train models | (1) pseudonymous user identifier, IP address, device and browser data, referring site, pages visited, pointer movement, scrolling, clicks (form fields and page text masked). (2) text of Listings, RFQs, Quotes, messages and Company descriptions selected by the User (may contain personal data) | (1) EU (Ireland); data may be processed in the USA. (2) EU - Azure region Germany West Central (Germany), Europe geography endpoint (EU Data Boundary) | EU-US Data Privacy Framework (Microsoft Corporation is certified) and standard contractual clauses in the Microsoft data protection agreement; for translation, processing in the EU, and any remote access from outside the EEA is covered by the same mechanisms |
| PostHog, Inc. | Product analytics (PostHog EU Cloud) across the signed-in application and public pages: started only after consent to the "Analytics" category | A pseudonymous, random identifier only; no page views and no user identifier are captured today. No name, e-mail or account identifier; the IP is not sent (first-party proxy). | EU (PostHog EU Cloud, Frankfurt) | EU (Frankfurt); per PostHog, data does not leave EU jurisdiction; our DPA with PostHog covers any access from outside the EEA |
| Google Ireland Limited | Google Analytics 4: audience and traffic analytics of the public pages of hiramtrade.com; started only after consent to the "Analytics" category | Pseudonymous usage data: a random identifier; with Enhanced Measurement on - page views, scrolls, outbound link clicks, video engagement and file downloads; location to city level; detailed device, browser and operating-system data. No name, e-mail or account identifier. According to Google, the IP address of users in the EU, the UK and Switzerland is not logged or stored. | Google Ireland Limited (EU); may be processed by Google LLC (US) | EU-US Data Privacy Framework (Google LLC; European Commission adequacy decision of 10 July 2023) and, where applicable, standard contractual clauses |
| Resend (USA) | Sending Service-related e-mails (address confirmation, password reset, invitations, notifications) from the hiramtrade.com domain | recipient e-mail address, first name, message content, delivery metadata, logs | EU - region eu-west-1 (Ireland) | standard contractual clauses in Resend's DPA, for access from the USA |
The Operator uses one advertising tool, the Meta pixel, and only with consent to the "Marketing" category; Meta Platforms Ireland Limited acts as an independent controller, not the Operator's processor (see the separate-controllers section below). The Operator uses no error monitoring tools. We start the analytics tools (Cloudflare Web Analytics and Microsoft Clarity) only after the user consents to the "Analytics" category.
Cloudflare, Inc. also acts as a processor for the Cloudflare Web Analytics tool (visit statistics without cookies), which we start only after the user consents to the "Analytics" category (see the "Cookie Policy"). Microsoft Ireland Operations Limited acts as a processor for the Microsoft Clarity tool (session recordings and heatmaps), also started only after consent, and - from the moment the feature is switched on - for machine translation on the User's request (Azure AI Translator).
2. Identity providers (separate controllers)
The providers below are not processors of the Operator. They process data as separate controllers when a User chooses to sign in through them. The Operator receives from them only an identity token (account identifier, e-mail address and whether it is verified, name and, for Microsoft, the tenant identifier).
| Provider | Purpose | Entity for EEA users | Transfer |
|---|---|---|---|
| Optional "Sign in with Google" (OpenID Connect) | Google Ireland Limited | under Google's privacy policy; Google LLC is certified under the EU-US Data Privacy Framework | |
| Microsoft | Optional "Sign in with Microsoft" (Microsoft Entra ID, work accounts) | Microsoft Ireland Operations Limited | under the Microsoft privacy statement; Microsoft Corporation is certified under the EU-US Data Privacy Framework |
Advertising (separate controller). Meta Platforms Ireland Limited provides the Meta pixel used for advertising measurement on public pages, only with consent to the "Marketing" category. Meta is not an identity provider and not the Operator's processor; it acts as an independent controller for the data it receives, under Meta's data policy. Any transfer to the USA (Meta Platforms, Inc.) is covered by the mechanisms in the Privacy Policy, section 6. See the "Cookie Policy" and the "Advertising measurement (Meta pixel)" section of the Privacy Policy.
3. Public sources and planned changes
- Registers and sanctions lists. For Company verification and sanctions screening the Operator retrieves data directly from public registers and lists (in particular VIES, KRS, the Polish VAT taxpayer list, and the sanctions lists of the EU, the UN, the United Kingdom and the USA). Their keepers are not processors of the Operator; the Operator does not pass Platform data to them beyond what a query requires (e.g. a VAT or KRS number).
- Payments and invoices. Once payments are launched on the Platform, of which we will give notice in accordance with this document, billing data will be processed by: the payment operator Stripe (Stripe Payments Europe, Limited, Ireland) - payments for Subscriptions and Success Fees, and inFakt (Poland) - issuing invoices, including through the National e-Invoicing System (KSeF).
- Artificial intelligence. The only feature of this kind is machine translation on the User's request (from the moment the feature is switched on), performed by Microsoft (Azure AI Translator) as the processor listed in the table above. The Operator does not use other artificial intelligence providers. We will update this document and the Privacy Policy before such features are launched.
4. Contact
Questions about subprocessors: privacy@hiramtrade.com.