Sub-processors
Last updated: 20 July 2026 · version 1.0
This is a courtesy translation. The Danish version is legally binding and prevails in case of any difference.
Nemma is provided by VIMESO.marketing v/ Lasse Berg Svenningsen, CVR no. 35124225, Merkurvej 4, 4200 Slagelse.
When you use Nemma as an online store, you are the controller, and we are the processor for the personal data processed in the service. To deliver the service, we use the sub-processors listed below.
This page is the public version of Annex B to our data processing agreement.
Current sub-processors
| Sub-processor | Purpose | Processing region | Transfer basis |
|---|---|---|---|
| Supabase | Database, user authentication and file storage - the primary storage of cases, messages and attachments | EU | Data is stored in the EEA. The supplier is US-registered, and Standard Contractual Clauses (SCCs) are used as a supplementary basis for any support and administration access |
| Vercel | Hosting of the application, server functions and environment variables | EU | As above |
| Resend | Receiving and sending of email | USA | Standard Contractual Clauses (SCCs) and, where the supplier is certified, the EU-U.S. Data Privacy Framework |
| Anthropic | AI inference - classification of enquiries and generation of draft replies | USA | Standard Contractual Clauses (SCCs) and, where the supplier is certified, the EU-U.S. Data Privacy Framework. Configured without data storage for training purposes |
Suppliers that are only taken into use if you activate a channel
Nemma currently supports email. Two further channels are ready in the service but are switched off and process no data until you connect them yourself. If you choose to do so, the supplier in question becomes a sub-processor from that point:
| Sub-processor | Purpose | Activated when |
|---|---|---|
| Meta Platforms | Receiving and sending of messages on Messenger and Instagram | You connect your Facebook page or Instagram account |
| Microsoft | Receiving of email from a Microsoft 365 mailbox via Microsoft Graph | You connect your Microsoft 365 mailbox |
Standard Contractual Clauses refers to the European Commission's Implementing Decision (EU) 2021/914.
Your own Shopify store is not a sub-processor
Nemma accesses your Shopify store via the access that you create and give to us yourself. Shopify is your own system under your own responsibility as controller, and Shopify is therefore not our sub-processor. The relationship between you and Shopify is governed by your agreement with Shopify.
Sub-processors for our own operations
For our own administrative purposes - e.g. invoicing you as a customer - we also use Stripe for payment processing. Stripe does not process personal data about your end customers and is therefore not listed as a sub-processor for the service. Read more in our privacy policy.
No training on your data
Personal data processed through the service is not used to train or improve AI models. See Annex D to the data processing agreement for the detailed terms.
Notification of changes
We give you at least 30 days' notice before we add or replace a sub-processor. The notice is given:
- by email to the address registered on your account, and
- by updating this page.
You can raise a reasoned objection to a change within the notice period. We will then seek to find a solution together with you. If we cannot reach agreement, and we cannot deliver the service without the sub-processor in question, you can terminate the affected part of the service with effect from the time the change takes effect.
You can subscribe to changes or ask questions by writing to us.
Contact
Questions and objections are sent to:
Email: info@nemma.dk
Post: VIMESO.marketing v/ Lasse Berg Svenningsen, Merkurvej 4, 4200 Slagelse