Shopware

Shopware AG is the operating entity, registered at Amtsgericht Coesfeld under HRB 11471 with German VAT ID DE261679493 and registered office Ebbinghoff 10, 48624 Schöppingen, North Rhine-Westphalia, Germany. The two-member management board is founders Stefan Hamann and Sebastian Hamann; the supervisory board is chaired by Christoph Hertz. The parent of Shopware AG is the German holding company Shopware Holding GmbH (Amtsgericht Coesfeld HRB 20410, same Schöppingen address), in which the Hamann brothers hold the majority and PayPal Holdings, Inc. holds around 41 percent. EU and German customers contract with Shopware AG; the legal department contact for the data processing agreement is legal@shopware.com. A separate US entity, Shopware US Inc., handles sales and marketing in the United States but does not host the SaaS infrastructure.

Shopware Cloud SaaS storage location is committed verbatim in DPA Annex IV: EU, region eu-central-1 in Frankfurt, Germany, on AWS EMEA SARL infrastructure. The observability subprocessor Datadog Inc. processes data in the Datadog Germany region. Shopware on Upsun PaaS lets the customer choose between AWS Europe (EU, UK, US, CA, AU), Microsoft Azure France (EU only), Google Cloud France (EU, UK, US), OVHcloud (EU only) and Platform.sh / Upsun itself (EU only). Customers who self-host the MIT-licensed Community or paid edition run Shopware entirely on their own infrastructure and choose their own residency. Annex II of the DPA declares that the processor does not collect or process Article 9 GDPR special-category data.

Shopware AG itself is a German private company controlled by its German management board, and the customer-data plane for Shopware Cloud SaaS sits in AWS Frankfurt. The CLOUD Act exposure runs through two indirect channels. First, the SaaS subprocessor chain: AWS EMEA SARL is a Luxembourg entity but ultimately a subsidiary of Amazon.com, Inc., and Datadog Inc. is a New York entity processing data in the EU region; both are reachable under 18 U.S.C. § 2713 for data within their possession, custody or control. Second, since 2025-10-21 PayPal Holdings, Inc. (Nasdaq: PYPL, US-listed) holds a strategic minority of around 41 percent of Shopware Holding GmbH after taking over the Carlyle Group stake; the Hamann brothers retain the majority and operational control, but PayPal is a US-listed shareholder with board representation. Customers who self-host on European sovereign hosts (such as Hetzner, IONOS, OVHcloud or Scaleway) or who pick the OVHcloud or Upsun PaaS regions avoid every US-domiciled processor in the production data path.

Shopware 6 publishes its full e-commerce core under the MIT license at github.com/shopware/shopware (Copyright 2019 shopware AG); the composer.json identifies the package as shopware/platform with type library and license MIT. The core is not crippled, dual-licensed or feature-gated relative to the paid editions: Community Edition users get the same MIT-licensed core that the Rise, Evolve and Beyond subscription editions extend with managed services, premium plugins (B2B Components, Advanced Search, Dynamic Access, Digital Sales Rooms, Multi-Inventory, Subscriptions) and managed cloud hosting. The Shopware Account portal and the Shopware Store extension marketplace are operated by Shopware as commercial services and gate above EUR 1 million annual GMV per the Fair Usage Policy, but the software itself is free to run. Around 3,100 community extensions are published in the Shopware Store, and Shopware was ranked No. 1 in open-source e-commerce software in the Emerce 100 2026.

Shopware publishes its subprocessor list directly in Annex IV of the Data Processing Agreement at shopware.com/en/privacy/dpa/ rather than on a separate page. The SaaS subprocessors are AWS EMEA SARL (IaaS, Frankfurt eu-central-1) and Datadog Inc. (monitoring, Germany region). The PaaS subprocessors are AWS EMEA SARL, Microsoft Azure France, Google Cloud France, OVHcloud and Platform.sh SAS doing business as Upsun. The shopware.com website itself uses a separate set of marketing and analytics processors disclosed in the website privacy notice at shopware.com/de/datenschutz/website/, including Usercentrics (consent management), HubSpot, Amplitude, Sentry, Dreamdata, Google products, Meta, LinkedIn, Microsoft Advertising, PayPal Luxembourg and Unzer; these never see Shopware Cloud customer data. Shopware commits to at least three months notice of any new subprocessor per Clause 7.7(a) of the DPA.

Every paid Shopware tier (Rise, Evolve, Beyond) is available as SaaS on AWS Frankfurt, as PaaS on Upsun over a customer-selectable European cloud region, or as a self-hosted installation on customer-controlled infrastructure. The free Community Edition is self-hosted only. The strongest sovereignty path is self-hosting the MIT-licensed core on a European host such as Hetzner, IONOS, OVHcloud or Scaleway, which removes Shopware AG from the data processing chain entirely. The next-strongest is Shopware on Upsun PaaS over the OVHcloud region, which keeps every subprocessor in the production data path in the European Union and avoids US-parent IaaS providers. Shopware Cloud SaaS on AWS Frankfurt offers EU residency but retains the AWS plus Datadog subprocessor chain with US-parent corporate exposure.