Legal
Data Sub-Processor List
First published: May 2026 · Last updated: October 2026
Age Requirement · 18+
This website and all of its services are intended for users who are 18 years of age or older. By accessing or using this website, you confirm that you are at least 18 years old. If you are under 18, you must not use this site.
LA MARZ & CO
DATA SUB-PROCESSOR LIST
Complete register of all third parties that process personal data on behalf of La Marz & Co
GDPR Article 28 Transparency
This document is legally binding. Please read it carefully before purchasing or using any La Marz & Co product.
Table of Contents
- Purpose of This Document
- Age Requirement — 18+ Only
- What Is a Sub-Processor?
- Our Obligations as Data Controller
- Complete Sub-Processor Register
- Whop Marketplace Inc. — Full Details
- Lovable — Full Details
- Analytics Providers — Not Currently Used
- Email Marketing Platform — Full Details
- TradingView — Affiliate Context
- Trade Nation — Affiliate Context
- Independent Controllers (Not Sub-Processors)
- Data Transfer Safeguards
- Sub-Processor Changes & Notification
- Your Rights in Relation to Sub-Processing
- Force Majeure
- Contact
GDPR TRANSPARENCY — ARTICLE 28
Under GDPR Article 28, data controllers must use only sub-processors that provide sufficient guarantees of GDPR compliance. This document lists all sub-processors engaged by La Marz & Co to process personal data on our behalf. First published: May 2026 · Last updated: October 2026.
1. Purpose of This Document
This Data Sub-Processor List is published to provide transparency about third parties that process personal data on behalf of La Marz & Co. It is intended for data subjects, regulators, legal representatives, and business partners requiring sub-processor information for their own GDPR compliance. Read alongside our Privacy Policy (lamarzco.com/privacy-policy) and Cookie Policy (lamarzco.com/cookie-policy).
2. Age Requirement — 18+ Only
18+ ONLY — AGE REQUIREMENT
La Marz & Co products, services, website, and all associated content are strictly directed at individuals aged 18 years or over. By accessing our website, purchasing any product, clicking any affiliate link, or engaging with any La Marz & Co content, you confirm you are at least 18 years of age. Individuals under 18 must not use our services. We do not knowingly collect data from, sell products to, or market to anyone under 18. To report a minor: contact@lamarzco.com — MINOR ACCESS REPORT.
3. What Is a Sub-Processor?
A sub-processor is a third party engaged by a data controller (La Marz & Co) to process personal data on the controller behalf, under the controller instructions. This is distinct from an independent data controller, who processes data for their own purposes (see Section 12). Under GDPR Article 28, La Marz & Co must only engage sub-processors that provide sufficient guarantees to implement appropriate technical and organisational measures.
4. Our Obligations as Data Controller
- Conducting due diligence on sub-processors before engagement
- Accepting written data processing terms with all sub-processors
- Ensuring sub-processors only process data on our documented instructions
- Ensuring sub-processors implement appropriate security measures
- Notifying you of changes to our sub-processor list
- Remaining liable to data subjects for sub-processor non-compliance
5. Complete Sub-Processor Register
| Sub-Processor | Location | Purpose | Data Subjects Affected | Transfer Safeguard |
|---|---|---|---|---|
| Whop Marketplace Inc. | United States | Order processing, payment, product delivery, customer account management | All customers (18+) | Whop seller DPA / SCCs |
| Lovable | EU/EEA (contact form database: Ireland) | Website hosting and basic visitor statistics for lamarzco.com; storing website contact form messages; sending contact form notification emails to us | Website visitors and contact form users (18+) | Database within EEA; email delivery: see Section 7 |
| Email marketing platform | Varies | Marketing and newsletter emails (where applicable) | Email subscribers (18+) | DPA per platform; SCCs where applicable |
6. Whop Marketplace Inc. — Full Details
| Field | Details |
|---|---|
| Legal name | Whop Marketplace Inc. |
| Country of establishment | United States |
| Privacy policy | whop.com/privacy |
| Data processing basis | Whop seller terms of service (includes data processing obligations) |
| Personal data processed | Customer name, email, order data, payment method type, purchase history, download records |
| Purpose | Order processing, payment processing, product delivery, customer account management, dispute resolution |
| Legal basis (La Marz & Co) | Contractual necessity |
| International transfer safeguard | Standard Contractual Clauses (SCCs) — EU Commission Decision 2021/914 |
| Data retention | Per Whop own retention policy — see whop.com/privacy |
7. Lovable — Full Details
| Field | Details |
|---|---|
| Legal name | Lovable (verify current legal entity at lovable.dev) |
| Country of establishment | EU/EEA |
| Privacy policy | lovable.dev/privacy |
| Personal data processed | Visitor IP addresses (anonymised), browser type, pages visited, session data, cookie consent records. Website contact form submissions: name, email address, message content, and a scrambled (non-reversible) version of the sender's IP address used only for spam prevention. |
| Purpose | Website hosting, serving lamarzco.com, basic aggregated visitor statistics, cookie consent management. Storing website contact form messages and delivering them to our inbox as email notifications. |
| Infrastructure | Contact form messages are stored in Lovable Cloud, which is built on Supabase and runs on Amazon Web Services in the EU (Ireland). Notification emails are sent through Lovable's own email infrastructure. |
| Legal basis (La Marz & Co) | Legitimate interests (operating our website, basic visitor statistics, and responding to enquiries) |
| International transfer safeguard | Contact form messages are stored within the EEA (Ireland) — no international transfer for storage. Lovable has not specified the location of its email delivery servers; any transfer outside the EEA in connection with email delivery relies on Lovable's standard contractual safeguards. |
| Data retention | Website contact form messages: 12 months from receipt, then automatically deleted |
8. Analytics Providers — Not Currently Used
La Marz & Co does not currently use Google Analytics or any other third-party analytics provider on lamarzco.com. Basic, aggregated visitor statistics are recorded by our website hosting provider, Lovable, as described in Section 7. If we add a third-party analytics provider in future, we will add it to this list before it begins processing, as set out in Section 14, and it will only run where you have given consent via our cookie consent banner.
9. Email Marketing Platform — Full Details
Where La Marz & Co operates an email marketing list, we use a third-party platform to send marketing emails. This section will be updated with specific platform details when activated.
| Field | Details |
|---|---|
| Personal data processed | Email address, name, email open/click data |
| Purpose | Sending marketing emails to opted-in subscribers (18+ only) |
| Legal basis | Consent (opt-in only — unsubscribe at any time) |
| Data retention | Until unsubscribe or consent withdrawal |
10. TradingView — Affiliate Context
| Field | Details |
|---|---|
| Legal name | TradingView, Inc. |
| Country of establishment | United States |
| Privacy policy | tradingview.com/privacy-policy |
| Personal data processed | Click referral data, affiliate conversion tracking cookies, subscription data for commission calculation |
| Purpose | Affiliate commission tracking and payment |
| Note | TradingView is also an independent data controller for data collected directly from users who register on tradingview.com |
11. Trade Nation — Affiliate Context
| Field | Details |
|---|---|
| Legal name | Trade Nation Financial Markets Limited (the Trade Nation entity our affiliate agreement is with). Depending on your country, a trading account may be opened with a different Trade Nation group entity. |
| Country of establishment | Seychelles. Regulated by the Financial Services Authority Seychelles (licence no. SD150); company no. 810589-1. Registered address: CT House, Office 6B, Providence, Mahé, Seychelles. |
| Privacy policy | tradenation.com/privacy-policy |
| Personal data processed | Click referral data (including the referring page, lamarzco.com), affiliate tracking cookies, account opening data for commission calculation; banner impression data (IP address, browser details) when the banner loads from Trade Nation's ad server after Third-Party Embeds consent |
| Purpose | Affiliate commission tracking and payment |
| Note | Trade Nation is also an independent data controller for data collected directly from users who open trading accounts |
12. Independent Controllers (Not Sub-Processors)
| Controller | Capacity | Privacy Policy |
|---|---|---|
| Whop Marketplace Inc. | Platform operator — collects data for own platform purposes | whop.com/privacy |
| Meta Platforms Inc. | Instagram platform operator | privacycenter.instagram.com |
| TikTok Ltd | TikTok platform operator | tiktok.com/privacy |
| X Corp | X/Twitter platform operator | x.com/privacy |
| Google LLC | YouTube platform operator | policies.google.com/privacy |
| Discord Inc. | Discord platform operator | discord.com/privacy |
| TradingView, Inc. | Charting platform operator | tradingview.com/privacy-policy |
| Trade Nation Financial Markets Limited | CFD broker; affiliate banner serving (tradenation.ck-cdn.com, only after Third-Party Embeds consent) and referral attribution when you click a Trade Nation link | tradenation.com/privacy-policy |
13. Data Transfer Safeguards
| Safeguard | Application |
|---|---|
| Standard Contractual Clauses (SCCs) | Used for transfers to Whop (US), TradingView (US), and other US-based processors |
| EU-US Data Privacy Framework | Used where a US-based processor is certified under the Framework |
| Adequacy decision | Used for transfers to countries recognised as providing adequate protection |
| UK GDPR IDTA | Used for UK-specific sub-processors where applicable |
Request details of specific safeguards: contact@lamarzco.com — Subject: DATA TRANSFER SAFEGUARDS REQUEST.
14. Sub-Processor Changes & Notification
La Marz & Co will update this list whenever we add or remove a sub-processor or when details change materially. Where we intend to add a new sub-processor that will process data of existing customers, we will update this list at least 30 days before the new sub-processor begins processing.
15. Your Rights in Relation to Sub-Processing
Your rights under GDPR apply to all personal data processed by La Marz & Co, including data processed by our sub-processors. Submit all data subject rights requests directly to us at contact@lamarzco.com — we will coordinate with sub-processors as required. La Marz & Co remains accountable to you for all sub-processing activities.
16. Force Majeure
La Marz & Co shall not be liable for failure to maintain full sub-processor compliance where such failure results from events beyond our reasonable control.
17. Contact
- Email: contact@lamarzco.com — Subject: DATA SUB-PROCESSOR ENQUIRY
- Website: lamarzco.com/contact
- Primary supervisory authority: Datatilsynet — datatilsynet.no
First published: May 2026 · Last updated: October 2026
Age Requirement · 18+
This website and all of its services are intended for users who are 18 years of age or older. By accessing or using this website, you confirm that you are at least 18 years old. If you are under 18, you must not use this site.
Full Legal Document
Read or download the full PDF
The downloadable PDF is the authoritative legally binding version of this document. The on-page summary above is provided for convenience.
© 2026 La Marz & Co. All Rights Reserved. | lamarzco.com | whop.com/la-marz-co