This is a translation provided for convenience. The Norwegian version at ithappens.no/underdatabehandlere is the legally binding text. Where the two differ, the Norwegian version governs.
ithappens is operated by SillySanta AS, org. no. 916 896 050 MVA, Lilletorget 1, 0184 Oslo, Norway.
How to read this page
The first table lists our sub-processors: parties that process personal data on ithappens' behalf, under our contract and our instruction, and therefore covered by the data processing agreement you sign with us. The second lists recipients on your behalf: you hold the contract with them, you decide whether they are switched on, and the portal transmits data to them on your instruction. They are not our sub-processors, so our 30-day notice and objection right does not apply to them. They are listed because they receive personal data and belong in your record of processing activities.
Sub-processors
These process personal data on our behalf when you use the returns portal. The list is complete.
| Provider | Function | Country | Data | Their own certifications |
|---|---|---|---|---|
| Salesforce (Heroku) | Hosting the application | Ireland 🇮🇪 | All return data during processing | ISO 27001, SOC 2 |
| MongoDB, Inc. (Atlas) | Database and backups | Sweden 🇸🇪 | All stored return data | ISO 27001, SOC 2 |
| Functional Software, Inc. (Sentry) | Error monitoring | Germany 🇩🇪 | Technical error context; may exceptionally contain identifiers | ISO 27001, SOC 2 |
| Twilio (SendGrid) | Sending email to the end customer | USA 🇺🇸, transfer on SCC basis | Name, email address, return reference | ISO 27001, SOC 2 |
| Stytch, Inc. | Login for administrators | USA 🇺🇸, transfer on SCC basis | Email addresses of the merchant's own users. No end-customer data. | SOC 2 |
The certifications in the last column are the providers' own. ithappens itself is not ISO 27001 certified and not SOC 2 certified.
Storage sits inside the EEA: the application in Ireland, the database and its daily backups in Sweden, error monitoring in Germany. Email delivery and administrator login route through the United States on the basis of the EU Standard Contractual Clauses.
Recipients on your behalf
These are not our sub-processors. You have your own agreements with them, and the portal sends data to them on your instruction. We list them anyway, because they receive personal data and belong in your record of processing activities.
| Recipient | Why | Data |
|---|---|---|
| Shopify | Order lookup, refunds, exchange purchases | Order and customer data already held in your store |
| PostNord, Bring, Profrakt, UPS, DHL, Webshipper | Shipping labels and tracking, only the ones you have enabled | Name, address, telephone number, email |
| Ongoing WMS | Scan-in at the warehouse, where you use it | Return reference and line items |
Changes
We notify existing customers at least 30 days before we start using a new sub-processor or replace an existing one. You can object within that period, and the terms for what happens then are set out in the data processing agreement (Norwegian).
To be notified automatically, send an email to henrik@ithappens.no with "subprocessors" in the subject line and you will be added to the notification list.
This list was last changed on 31 July 2026.