---
title: Understand GDPR Data Processing
url: https://docs.maxio.com/configuration/compliance/understand-gdpr-data-processing
applies_to: Advanced Billing
updated: 2026-09-19
---

# Understand GDPR Data Processing

Under GDPR, Advanced Billing acts as a **data processor** on your behalf: you manage consent and data governance as the Merchant, and Maxio keeps the systems handling your Customer data secure and compliant.

## When you need these lists

The sub-processors, third-party vendors, and integration partners named below are what you need when completing a privacy impact assessment, preparing for an audit, or answering a Customer's question about how their personal data is handled.

## Our GDPR compliance commitments

The commitments below describe what Maxio takes on as your processor, and they are the points most often asked about in a privacy impact assessment or vendor review.

- Safeguard your data through secure infrastructure, encryption, and access controls.
- Maintain certifications (e.g., EU-U.S. Privacy Shield or successors) to support cross-border data transfers.
- Disclose all sub-processors and conduct ongoing reviews of their GDPR compliance.
- Maintain detailed compliance records, audit trails, and system logs.
- Provide tools and workflows to support data subject rights (DSRs), such as right-to-access and right-to-erasure.
- Offer standardized Data Processing Addendums (DPAs) for all customers.
- Promptly notify your designated account contact in the event of a security breach, in accordance with our incident response protocols.

## How to request a Data Processing Addendum (DPA)

Our standard Data Processing Addendum (DPA) is available for Advanced Billing customers. To request a copy, email [support@maxio.com](mailto:support@maxio.com) and our Legal team will respond within 3–5 business days.

## Data processors

When a Merchant’s employee accesses the Advanced Billing system, we use various data processors. These do not receive personal information about subscribers or end-customers.

- <a href="https://www.twilio.com/gdpr" target="_blank" rel="noopener noreferrer">Twilio</a>
- <a href="https://www.zoho.com/lp/gdpr.html" target="_blank" rel="noopener noreferrer">Zoho</a>
- <a href="https://www.salesforce.com/eu/campaign/gdpr/" target="_blank" rel="noopener noreferrer">Salesforce</a>
- <a href="https://segment.com/product/gdpr" target="_blank" rel="noopener noreferrer">Segment</a>
- <a href="https://blog.autopilothq.com/what-is-gdpr/" target="_blank" rel="noopener noreferrer">Autopilot</a>
- <a href="https://blog.mailchimp.com/gdpr-forms-and-more-tools/" target="_blank" rel="noopener noreferrer">Mailchimp</a>
- <a href="https://zapier.com/help/gdpr/" target="_blank" rel="noopener noreferrer">Zapier</a>
- <a href="https://www.zendesk.com/company/customers-partners/eu-data-protection/" target="_blank" rel="noopener noreferrer">Zendesk</a>

## Sub-processors

These services may store or process personal data of your subscribers, depending on your configuration:

- <a href="https://aws.amazon.com/compliance/gdpr-center/" target="_blank" rel="noopener noreferrer">Amazon Web Services</a>
- <a href="https://www.sumologic.com/compliance/what-is-gdpr/" target="_blank" rel="noopener noreferrer">SumoLogic</a>
- <a href="https://sendgrid.com/resource/general-data-protection-regulation/" target="_blank" rel="noopener noreferrer">SendGrid</a> (if email is enabled)
- <a href="https://www1.avalara.com/us/en/legal/terms.html" target="_blank" rel="noopener noreferrer">Avalara</a> (if tax integration is enabled)
- <a href="https://www.honeybadger.io/gdpr/" target="_blank" rel="noopener noreferrer">Honeybadger</a>
- <a href="https://help.heroku.com/RXPQ7FOV/eu-general-data-protection-regulations-gdpr" target="_blank" rel="noopener noreferrer">Heroku</a>
- <a href="https://cloud.google.com/security/gdpr/" target="_blank" rel="noopener noreferrer">Google Cloud</a>

## Third-party integration partners

Maxio provides optional integrations through APIs, built-in connectors, and webhooks. We do *not* evaluate the GDPR compliance of these third-party services. Merchants are responsible for conducting their own due diligence and ensuring appropriate data processing agreements are in place.

- Your chosen Gateway or Payment Processor
- Avalara
- Xero
- QuickBooks Online
- Salesforce
- Mailchimp
- Shopify
- Twilio