Subprocessors
An explanatory notice about providers that may process data for Valmera services.
Last updated: 08.31.2026 | Louisville, Kentucky
Back to home1. Purpose of this page
A subprocessor is a third-party provider engaged by a data processor to handle personal data for its customer. This page explains the categories of providers a future Valmera hosted service might use. It is not a finalized or exhaustive list of providers for a production SaaS product, because a verified active vendor inventory has not been provided.
2. Current public website infrastructure
This site is designed for Shopify. Shopify provides hosted storefront functions and may handle website visitor information and inquiry routing under its applicable terms and privacy responsibilities. Shopify is identified here as website infrastructure, not automatically as a subprocessor for any future Valmera customer workspace. Additional Shopify apps or theme integrations, if installed, require separate verification.
3. Possible future service categories
A launched collaboration platform may require infrastructure hosting, managed databases, email delivery, file storage, monitoring, support tooling, and security services. Naming these service categories does not mean Valmera Labs has engaged a particular vendor or that any specified customer data is presently processed through such a service.
4. Publishing a verified register
Before enterprise or other processor-based customer data processing starts, a live register should identify each relevant provider, service supplied, categories of information accessed, processing location where required, transfer safeguards, and the effective date of engagement. Customer notice or objection procedures, if applicable, should be set out in the executed DPA.
5. Changes and customer questions
When verified provider details are available, this page should be revised to identify active subprocessors accurately and include the applicable last-updated date. Until then, prospective customers can request written vendor and data-flow information as part of the service due-diligence process. Do not rely on this notice as an assurance that an unverified provider is or is not being used.
6. Website versus customer service processing
The public Valmera Labs website is presented through Shopify. Its contact and privacy functions may involve Shopify infrastructure and configuration selected by the website operator. A future hosted workspace, if offered under a customer agreement, may use different infrastructure and service providers. This register should not be read as identifying vendors that have not been contracted or confirmed. Client data processing and service subprocessing require a current inventory based on actual deployment.
7. Provider inventory requirements
Before a provider is entered into a contractual subprocessor register, Valmera Labs should verify the legal entity, service category, processing purpose, categories of customer information involved, countries of processing, relevant contractual terms, and any transfer mechanisms. Where required by the customer agreement or applicable law, the register should provide notice of intended additions or replacements and a process to raise a reasonable objection.
8. Possible categories of providers
Depending on the actual service architecture, relevant categories could include hosting and content delivery, email delivery, infrastructure security, observability, encrypted backups, customer support, document collaboration, or transactional communications. Listing a category here is not a claim that any particular provider or service is in use. Vendors should be named only once the contract and relevant technical access have been confirmed.
9. Subprocessor obligations
An applicable written agreement with an approved subprocessor should impose confidentiality, security, data-use limitations, and lawful instructions appropriate to the processing and applicable data-protection requirements. Where a company processes customer personal information as a processor, it remains responsible for meeting its obligations to the customer under its executed agreement, subject to governing law and the agreed allocation of responsibility.
10. Change management
A maintained inventory should include an effective date, prior changes, affected processing functions, and a responsible business contact. Where advance notification is contractually required, the company should deliver it through the agreed channel and record customer objections and responses. Material changes to personal-data hosting or access should also be reviewed for data residency or international transfer consequences.
11. Requests about actual providers
A prospective customer may inquire about how the website handles business information and which providers are used for a proposed service. A business customer with a signed contract should request the applicable service-specific schedule or subprocessor list. Valmera Labs should not represent this public informational page as a substitute for a contractual inventory or as a guarantee of a particular hosting location.
12. Minimum information for customer review
For a customer that needs to review a vendor before entering a services agreement, a service-specific disclosure should identify whether the vendor is a processor, subprocessor, or independent controller; the kind of business records it receives; its function; relevant data locations; and the contractual safeguards used for that purpose. If a provider operates multiple products, only the products actually involved in the contracted service should be identified. A privacy notice for a public Shopify website is not, by itself, evidence of which entities process customer workspace data.
13. Confidentiality and access limitations
Provider contracts should restrict customer information to authorized services and personnel, prohibit independent unauthorized uses, and require appropriate access and security measures. When the company provides customers with workflow configuration or written documentation without hosting their personal information, the role of a vendor may be different from the role required for a hosted workspace. These distinctions should be assessed before adding an entity to the service-specific list.
14. Customer notification and objections
If an executed agreement promises notice of a new subprocessor, the agreed method and timing control. An affected customer should receive enough information to evaluate the change, raise a reasoned objection if permitted, and understand any choices available under the contract. The public page can support transparency, but it does not replace specific contractual notices or unilaterally change data protection obligations.
Contact Information
For questions about this document or requests that concern your information or use of the site, you may contact Valmera Labs using the details below. Please do not send passwords, financial account numbers, or unnecessary sensitive personal information in an inquiry.
EMAIL: projects@valmeralabs.com
ADDRESS: 2520 Terra Crossing Blvd, Louisville, KY 40245
PHONE: +1 (502) 693-1012