List of Processors and Data Recipients
Last updated: 26 October 2026
This page is part of our Privacy Notice and lists the external companies with which we share your personal data when you use our online store. We keep it up to date, so the Privacy Notice itself does not change each time a recipient changes.
Role shows each company's status under the GDPR: a processor acts only on our instructions; a joint controller decides together with us (you may exercise your rights against either party); an independent controller acts under its own privacy policy. Location and safeguard shows where your data is processed and, for transfers outside the EEA, the safeguard we rely on (see § 2 and § 7 of our Privacy Notice for data categories and transfers).
Questions? Contact us at privacy@pocketbook.de.
Payment
|
Provider |
Service |
Data categories shared |
Role |
Location & safeguard |
Policy |
|
MultiSafepay |
Payment processing |
Inventory data (name), contact data, payment & transaction data |
Processor (Art. 28) |
EU |
|
|
Trustly Group AB |
Pay by Bank payments, payment initiation and transaction processing |
Order and transaction identifiers, payment amount, payment status and customer identification data, where applicable. Bank account and related financial information may be processed by Trustly when the customer uses the service. |
Independent controller (Art. 4(7) GDPR) |
EU (Sweden); international transfers, where applicable, subject to adequacy decisions or appropriate safeguards, including SCCs |
Delivery and logistics
|
Provider |
Service |
Data categories shared |
Role |
Location & safeguard |
Policy |
|
DPD |
Delivery of physical goods |
Name, delivery address, contact data (phone/e-mail for delivery notices) |
Processor (Art. 28)/ Independent controller (Art. 26) |
EU |
|
|
DHL |
Delivery of physical goods |
Name, delivery address, contact data (phone/e-mail for delivery notices) |
Processor (Art. 28)/ Independent controller (Art. 26) |
EU |
|
|
Komsa |
Delivery of physical goods (warehousing, shipping and fulfilment) |
Name, delivery address, contact details, order and shipment information |
Processor (Art. 28 GDPR) |
EU |
Communications & marketing
|
Provider |
Service |
Data categories shared |
Role |
Location & safeguard |
Policy |
|
CleverReach |
Newsletter & reminder dispatch, open/click measurement |
E-mail address, usage & technical data |
Processor (Art. 28) |
EU (Germany) |
|
|
OneSignal |
Push notifications |
Device identifiers, usage data |
Processor (Art. 28) |
US — EU-U.S. DPF |
|
|
Swat.io |
Social media management |
Contact data, content of interactions |
Processor (Art. 28) |
EU (Austria) |
Analytics & personalisation
|
Provider |
Service |
Data categories shared |
Role |
Location & safeguard |
Policy |
|
Google Analytics |
Website analytics |
Usage & technical data, online identifiers |
Processor (Art. 28) |
US — DPF / SCC |
|
|
Dymatrix (Econda) |
Website analytics & optimisation |
Usage & technical data (pseudonymised) |
Processor (Art. 28) |
EU (Germany) |
Advertising
|
Provider |
Service |
Data categories shared |
Role |
Location & safeguard |
Policy |
|
Google Ads |
Advertising |
Usage & technical data, online identifiers |
Processor (Art. 28) |
US — DPF / SCC |
|
|
Meta (Pixel) |
Advertising & audience measurement |
Usage & technical data, online identifiers, hashed e-mail |
Joint controller (Art. 26) |
US — DPF / SCC |
|
|
Tradedoubler GmbH |
Affiliate marketing network and conversion tracking services |
Online identifiers, cookie identifiers, IP address, referral source information, transaction identifiers, order identifiers, purchase and transaction information, transaction status information (e.g. completed, cancelled or returned transactions), device and browser-related technical information |
Joint controller (Art. 26), |
EU Tradedoubler uses service providers and subprocessors, including providers located inside and outside the EEA. Where personal data is transferred outside the EEA, appropriate safeguards such as Standard Contractual Clauses (SCCs) should apply. |
Search & merchandising
|
Provider |
Service |
Data categories shared |
Role |
Location & safeguard |
Policy |
|
FACT-Finder (Omikron) |
Search, navigation, recommendations |
Usage & technical data, order data |
Processor (Art. 28) |
EU (Germany) |
Customer support
|
Provider |
Service |
Data categories shared |
Role |
Location & safeguard |
Policy |
|
ArminCX (chatarmin.com GmbH, Austria) |
Automated support replies |
E-mail address, name, request content |
Processor (Art. 28) |
EU (servers in Germany) |
After-sales (repair)
|
Provider |
Service |
Data categories shared |
Role |
Location & safeguard |
Policy |
|
Fixit Service (authorised service partner of PocketBook) |
Warranty & repair handling, RMA processing |
Name, contact details, shipping address, device serial number, device model, order/RMA details, repair information |
Processor (Art. 28) |
EU |
Ratings & reviews
|
Provider |
Service |
Data categories shared |
Role |
Location & safeguard |
Policy |
|
Google (review service) |
Review collection / display |
E-mail (hashed), review content |
Independent controller
|
US — DPF |
|
|
Trusted Shops SE |
Trustbadge, customer reviews, buyer protection and related review invitations |
Technical access data (IP address, date and time of access, request information); order number, order value, order date/time, hashed email address; email address and relevant order information when the customer actively registers for buyer protection |
Joint controller (Art. 26 GDPR) for specified processing activities |
EU (Germany); service providers in the US and Israel, where applicable (adequacy decisions, EU-U.S. DPF or SCCs) |
IT, hosting & infrastructure
|
Provider |
Service |
Data categories shared |
Role |
Location & safeguard |
Policy |
|
Microsoft |
Cloud hosting |
All data categories stored on hosted systems |
Processor |
US — DPF / SCC |
|
|
Adobe |
Adobe ID / DRM activation |
Account identifier, Adobe ID |
Independent controller |
EU (Ireland) + US — DPF |
|
|
Objectis Ltd (CookieScript) |
Cookie consent management and recording of consent preferences |
Consent preferences, pseudonymous identifiers, consent timestamps, browser and device information |
Processor (Art. 28 GDPR) |
EU |
Group companies
|
Provider |
Service |
Data categories shared |
Role |
Location & safeguard |
Policy |
|
PocketBook International SA |
Platform, database, governance |
All data categories (platform & database operation) |
Joint controller (Art. 26) |
Switzerland — adequacy decision |
— |
|
Software developers, IT service providers and customer support providers engaged by PocketBook outside the EU/EEA |
Software development, IT services, customer support |
Customer account data, contact details, support requests, device identifiers, service usage information, technical and diagnostic data required for support and service operations |
Processor |
Outside EU/EEA; transfers safeguarded by Standard Contractual Clauses (SCCs) |
— |
Content partners
|
Provider |
Service |
Data categories shared |
Role |
Location & safeguard |
Policy |
|
Content partners and aggregators |
Provision and licensing of e-books and audiobooks |
Name, email address, user/account ID, order/transaction identifiers, purchase history, library records, DRM-related identifiers, support ticket information |
Processor (for content fulfillment and library management) |
EU
|
— |