Sub-processors

Last updated: 28 August 2026

1. What this page is for

A sub-processor is a company that processes personal data on our behalf so that we can provide the MASAT service. Article 28 GDPR requires us to tell you who they are, what they do and where they process data, and to give you notice before we change them.

This page is referred to in our Privacy Policy and in the Data Processing Agreement and forms part of both.

2. Current sub-processors

Amazon Web Services
Role: hosting of the application, databases and backups.
Data processed: all data stored in the MASAT application.
Place of processing: European Union.

Stripe Payments Europe, Ltd.
Role: payment processing, subscription management, fraud prevention.
Data processed: billing data, transaction data, card details (handled exclusively by Stripe, never by MASAT).
Place of processing: European Union, with transfers to the United States under the Standard Contractual Clauses and the EU–US Data Privacy Framework.

OpenAI
Role: generating text suggestions in the Listing Optimizer (titles, descriptions, keywords).
Data processed: product data only. No end-customer personal data is sent.
Place of processing: United States, under the Standard Contractual Clauses.

Google
Role: generating product images in the Listing Optimizer (Gemini models); serving the YouTube videos embedded on our website, in no-cookie mode.
Data processed: product data and images only. No end-customer personal data is sent.
Place of processing: European Union and United States, under the Standard Contractual Clauses and the EU–US Data Privacy Framework.

Nitrosend
Role: transactional and marketing e-mail, newsletters.
Data processed: e-mail address, name, communication preferences, interaction with messages.
Place of processing: European Union.

FirstPromoter
Role: administration of the affiliate programme — referral tracking, commission calculation, affiliate dashboard.
Data processed: affiliate identification and contact data, payment details, click, sign-up and conversion statistics.
Place of processing: European Union.

PostHog
Role: product analytics and session recording inside the application at app.masat.ro — which features are used, where people run into trouble, and replays of interface usage used to find bugs.
Data processed: account identifier, actions performed in the application, technical data, and the content visible on screen during a recorded session.
Place of processing: according to the region configured for the PostHog account; requests are routed through our own domain (t.masat.ro). Standard Contractual Clauses apply to any transfer outside the EU.

Meta Platforms Ireland Ltd.
Role: measuring advertising campaigns on the website (Meta Pixel).
Data processed: online identifiers, cookies, site interaction. Only with your consent.
Place of processing: European Union and United States, under the Standard Contractual Clauses and the EU–US Data Privacy Framework.

3. Who is not on this list

Our accountants, lawyers and auditors act as independent controllers or under their own professional confidentiality obligations and are not sub-processors within the meaning of Art. 28 GDPR. Public authorities receive data only where the law requires it.

eMAG (Dante International S.A.) is not a sub-processor of MASAT. eMAG is the source of the data and your own contractual counterparty; MASAT connects to your account at your request.

4. How we notify changes

We announce the addition or replacement of a sub-processor at least 30 days in advance, by e-mail to account holders and by updating this page.

You may object, with reasons and in writing, within 15 days of the notification, by writing to office@masat.ro. If we cannot agree on a solution and the objection makes it impossible for us to provide the service, you may terminate your subscription with a pro-rata refund of the unused period.

5. Our commitments regarding sub-processors

  • We impose on each sub-processor, by contract, the same data protection obligations we owe you.
  • We remain fully liable to you for their performance of those obligations.
  • We assess each provider before engaging it and review the list periodically.
  • We use the minimum number of providers necessary to deliver the service.

6. Contact

S.C. MASAT DIGITAL S.R.L.
Ilfov County, Bragadiru, 59 Ghidiceni Street
E-mail: office@masat.ro
www.masat.ro