Subprocessors List
Last updated: April 2026 · Version 1.0
This page lists the sub-processors used by Hobbio Inc ("Fenicia") to provide the Service. It forms an integral part of the Data Processing Addendum (DPA) and allows the Customer to be aware of and, where applicable, object to the use of sub-processors pursuant to § 7 of the DPA.
1. What is a Sub-processor?
A sub-processor is a third party engaged by Fenicia to process the Customer's Personal Data as part of providing the Service. Each sub-processor is contractually bound to maintain data protection and security standards equivalent to those set forth in the DPA.
We distinguish two types:
- Infrastructure Sub-processors: providers essential to the operation of the Service, used across all tenants without exception.
- Optional integrations: providers used only when the Customer actively chooses to connect the Service with them (e.g., a marketplace or a courier). In these cases, the Customer acts as direct Controller in relation to the third party, and Fenicia facilitates data exchange under the Customer's instructions.
2. Infrastructure Sub-processors
These sub-processors are essential to provide the Service to all Customers. Using Fenicia necessarily entails data processing by these parties.
| Subprocessor | Purpose | Location | Data categories |
|---|---|---|---|
| Amazon Web Services, Inc. (AWS) | Cloud infrastructure: compute (Lambda), object storage (S3), messaging (SQS, SNS, EventBridge), transactional email (SES), secrets management (Secrets Manager), observability (CloudWatch), API Gateway. | United States (us-east-1 region) | All Service operational data, including personal data processed on behalf of the Customer. |
| MongoDB, Inc. (MongoDB Atlas) | Primary operational database of the Service (multi-tenant with tenantId isolation). | United States | Products, inventory, orders, customers, integration configuration, operational history. |
| Stripe, Inc. | Subscription payment processing (recurring billing by Hobbio Inc), payment method management, and subscription invoice issuance. | United States | Customer billing data: billing contact email, name, billing address, payment method information (tokenized, not stored by Fenicia), invoice history. |
3. Customer-Initiated Optional Integrations
These integrations are activated only when the Customer deliberately connects them from the admin panel. The list may vary depending on which integrations the Customer uses. Communication with these third parties is carried out under their respective terms and policies, which the Customer accepts directly with them upon connecting its account.
| Subprocessor | Purpose | Location | Data categories |
|---|---|---|---|
| Shopify Inc. | Sync of products, inventory, customers, and orders with Shopify stores connected by the Customer. | Canada / United States | Customer product, order, and end-customer data. |
| Amazon Services LLC (Selling Partner API) | Integration with Amazon Marketplace selected by the Customer. | United States | Orders, products, inventory, and marketplace end-customers. |
| MercadoLibre | Integration with MercadoLibre selected by the Customer. | Argentina / regional | Orders, products, inventory, and marketplace end-customers. |
| Walmart Inc. (Marketplace API) | Integration with Walmart Marketplace selected by the Customer. | United States | Orders, products, inventory, and marketplace end-customers. |
| Liverpool (Marketplace) | Integration with Liverpool selected by the Customer. | Mexico | Orders, products, inventory, and marketplace end-customers. |
| Shein | Integration with Shein selected by the Customer. | Regional | Orders, products, inventory, and marketplace end-customers. |
| TikTok Shop | Integration with TikTok Shop selected by the Customer. | Regional | Orders, products, inventory, and marketplace end-customers. |
| Coppel | Integration with Coppel Marketplace selected by the Customer. | Mexico | Orders, products, inventory, and marketplace end-customers. |
| TiendaNube (NuvemShop) | Integration with the TiendaNube/NuvemShop store platform selected by the Customer. | Regional | Customer product, order, inventory, and end-customer data. |
| WooCommerce | Integration with WooCommerce stores selected by the Customer. | Customer infrastructure | Customer product, order, inventory, and end-customer data. |
| DHL | Shipping label generation and tracking. | Germany / global | Delivery addresses, recipient contact data, package dimensions and weights. |
| FedEx | Shipping label generation and tracking. | United States / global | Delivery addresses, recipient contact data, package dimensions and weights. |
| UPS | Shipping label generation and tracking. | United States / global | Delivery addresses, recipient contact data, package dimensions and weights. |
| Estafeta | Shipping label generation and tracking in Mexico. | Mexico | Delivery addresses, recipient contact data, package dimensions and weights. |
| Skydropx | Shipping aggregator in Mexico. | Mexico | Delivery addresses, recipient contact data, package dimensions and weights. |
| T1 Envíos | Shipping label generation and tracking in Mexico. | Mexico | Delivery addresses, recipient contact data, package dimensions and weights. |
| Mercado Pago | Processing of the Customer's end customer payments when used as a payment gateway. | Regional | End-customer payment data (tokenized by Mercado Pago). |
| OpenPay | Processing of the Customer's end customer payments when used as a payment gateway. | Mexico | End-customer payment data (tokenized by OpenPay). |
| Meta Platforms, Inc. | Facebook Shop and Instagram Shop integrations selected by the Customer. | United States | Customer products, catalogs, and store information. |
| Google LLC (Google Merchant Center) | Publication of Customer products on Google Shopping when configured. | United States | Customer products, catalogs, and commercial information. |
| HubSpot, Inc. | Sync of CRM contacts and pipelines when configured. | United States | Customer contact data for leads and customers. |
4. Change Notification
Fenicia will notify any addition, removal, or replacement of infrastructure sub-processorsat least thirty (30) calendar days in advance by:
- Updating this page with a new version number and date.
- Notifying the Billing Contact of Customers subscribed to the change notification channel.
Additions or removals of optional integrations are published directly on this page without individual advance notice, as they only affect Customers who have activated such integration.
5. Right to Object
Pursuant to § 7 of the DPA, the Customer may object on reasonable data protection grounds to the use of a new infrastructure sub-processor, within thirty (30) days following the notification, by emailing legal@fenicia.io.
Fenicia will make reasonable efforts to offer a commercially viable alternative. If such alternative is not possible, the Customer shall have the right to terminate the contract without penalty with respect to the affected component, with a pro-rated refund of the unused period.
6. Change History
This section maintains the history of modifications to the sub-processor list to ensure the traceability required by data protection regulations.
- April 2026 — v1.0: initial publication of the sub-processor list.
Contact
Email: legal@fenicia.io