Sub-processors and service providers

1. What this register covers

Orsun Tech OÜ uses different suppliers to operate OrsunPay’s website and business services. A supplier is a sub-processor under a customer’s DPA only where it processes that customer’s personal data on our behalf. A website analytics or documentation supplier is not automatically a processor of payment information.

This register identifies infrastructure and service providers used or supported by OrsunPay. It is not a representation that every optional service is enabled, that a provider receives every category of data, or that all customer-specific processing locations have been agreed. The table below describes their roles; the executed DPA must identify the authorised legal entities and actual arrangements.

2. Functions and data access

Railway provides the application hosting infrastructure described in our deployment configuration. Depending on the service deployed, this can involve website connection information, enquiry records, application records and database storage. The OrsunPay production regions, backup locations and contractual details require confirmation. See Railway’s DPA.

Resend, when selected as the email provider, delivers transactional messages and enquiry notifications. These can include recipient and reply addresses, enquiry contents, authentication messages and delivery metadata. Resend states that stored customer data is in the United States; choosing an EU sending region does not change storage location. See Resend’s data residency information. Confirm the active sending provider and account terms before treating this as a final appointment.

Plausible, when enabled for the public website, receives limited page and interaction events. The website does not attach contact-form content or merchant transaction details to these events. Plausible states that visitor data is processed in the European Union. See its data policy. Production activation and the applicable account agreement remain to be confirmed.

Cloudflare is described in the deployment guidance for the website’s proxy and security path. Where that path is enabled, it can handle connection metadata and requests passing through its network. Confirm the enabled products, applicable terms and processing locations; do not infer that all edge processing occurs in an application’s hosting region.

Mintlify is the documentation publishing system supported by the repository. A hosted documentation deployment may receive visitor connection and usage information. Its use for production hosting, settings and processing locations must be confirmed separately; repository support does not establish an active hosted appointment.

3. Connected payment providers

Payment providers selected by a merchant participate under the relevant provider agreements. Their privacy roles depend on the activity and contract. A provider’s appearance in our integration catalogue does not automatically make it an OrsunPay sub-processor or mean that it receives your information. Review the providers enabled for your own integration.

4. Changes and questions

Customer authorisation and advance notice of sub-processor changes follow the executed DPA. Publication of a revised table is not a substitute for an agreed direct-notification procedure. The final schedule must specify the notification channel, notice period and process for considering objections.

Use Contact to request the supplier information relevant to a proposed deployment. The privacy notice explains the operator, individual rights and international-transfer review.