Subprocessors
In force from 1 September 2026 · version 2
This is an English translation provided for convenience. The Polish version is legally binding. In case of any discrepancy, the Polish version prevails. Read the Polish version.
Contents · 5 sections
- A subprocessor is a company that helps us provide the service — for example, by hosting servers or reading the text on a receipt.
- We keep servers, databases, files and backups in Europe.
- Two things require providers from outside Europe: receipt recognition and phone notifications. We say so plainly instead of hiding it.
- We notify you by e-mail 30 days in advance of any change to the list.
This summary makes the document easier to read but does not replace it. The full document is binding — in its Polish version.
1Who subprocessors are
A subprocessor is a further processor within the meaning of Art. 28(4) of the General Data Protection Regulation (GDPR) — a company to which we entrust part of the data processing so that we can provide the service. We could not operate without servers or a service that recognises text in a photo, so we use specialised providers instead of building these ourselves.
We contractually impose on each subprocessor the same data protection obligations that we owe to you. We are liable for their actions as for our own.
2List of subprocessors
| Entity | What we use it for | What data | Where it processes data |
|---|---|---|---|
| Amazon Web Services | Servers, databases (PostgreSQL, Redis, MongoDB), files and backups | all data in the account | European Union (Frankfurt) |
| Amazon SES | Sending e-mails: invitations with a code, invoices, deadline reminders | e-mail address, message content and attachments | European Union |
| Mapbox | Route planning and converting addresses into coordinates | loading and unloading addresses, vehicle positions | European Union |
| Google Cloud (Vision) | Recognising text in photos of receipts | photos of receipts and the amounts read from them | European Union, entity outside the EEA |
| Stripe | Subscription payments and invoices for the service | company billing details, e-mail address | European Union (Ireland) |
| Sentry | Application error reporting | user identifier, IP address, error context | European Union |
| Apple (App Store, notifications) | Distribution of the driver app and delivery of notifications | device token, notification content | outside the EEA |
| Google (Google Play, notifications) | Distribution of the driver app and delivery of notifications | device token, notification content | outside the EEA |
We collect service performance statistics using Grafana running on our own servers — it is not a separate subprocessor, because the data does not leave our infrastructure.
3Who is not a subprocessor
The application also connects to systems that do not process data on our behalf — for completeness, we list them separately:
- National e-Invoicing System (Krajowy System e-Faktur, KSeF)
- — a system operated by Poland’s Ministry of Finance. We send invoices there on your instructions; the controller of data in KSeF is the public authority, not us.
- National Bank of Poland (Narodowy Bank Polski)
- — a public exchange rate API. We only retrieve exchange rates, without transmitting any data.
- VIES (European Commission)
- — verification of business partners’ VAT numbers. We transmit the company’s VAT number, not personal data.
- Grafana
- — charts of service load and availability. It runs on our servers; the data does not reach the software vendor.
- Contact form on the website
- — a message sent from busikm.pl is stored in a Firestore database (Google Ireland, European region), and the notification about it is delivered by Resend from servers in Ireland. These are not subprocessors within the meaning of this register: they concern data for which we are the controller, not data entrusted to us by clients. They are listed in the Privacy Policy.
4Processing outside Europe
Servers, databases, files, backups, e-mail and payments operate within the European Union. Two things, however, require entities outside the European Economic Area: recognising text on receipts, and delivering notifications to the phone, which always goes through Apple or Google.
We safeguard the transfer with standard contractual clauses approved by the European Commission. We set receipt recognition to the provider’s European region. A notification contains the device token and a short message — never photos, documents or billing data.
If you would prefer photos of receipts not to leave Europe, write to us — we can switch your account to a recognition engine running on our own servers. Recognition is then slightly less accurate.
5Changes to the list
We notify you by e-mail at least 30 days before any intended addition or replacement of a subprocessor. In the message, we give the name of the entity, the scope of processing and the place where the data is processed.
During that time, you may raise a reasoned objection. We will try to find a solution — for example, by proposing a different provider. If that is not possible, you may terminate the agreement with effect from the date the change takes effect, at no cost.
Would you like to be notified of changes to this list even though you are not a client yet? Write to kontakt@busikm.pl and we will add you.
Last updated: 3 September 2026
Other documents:Terms of ServicePrivacy PolicyData Processing Agreement
Have a question about this document? Write to: kontakt@busikm.pl