CCV Shop
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Dutch hosted e-commerce SaaS from €36/mo; 0% transaction fees; parent company CCV Group is Fiserv-owned (US).
CCV Shop offers EU hosting in the Netherlands, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under E-commerce.
Assessment notes
CCV Shop is Dutch-operated (KvK 08084328, Hengelo NL), but its parent CCV Group B.V. is owned by Fiserv Inc. (NYSE: FI, US), making this a US-ultimate-owner situation with material CLOUD Act exposure. No public DPA or sub-processors list found; these must be requested via sales.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent This listing European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: No
Jump to
About CCV Shop
CCV Shop (Diamantstraat 3, Hengelo, Netherlands, KvK 08084328) is a Dutch hosted e-commerce platform offering plans from €36/month (Basic, up to 50 products) to €129/month (Enterprise, unlimited products + B2B), all with 0% transaction fees and a 21-day free trial. The platform supports multi-language storefronts, API access (Professional+ plans), and multiple payment providers. CCV Shop is operated by the CCV Group, a Dutch payments + commerce company with 900 employees serving 150,000+ customers across Europe. However, CCV Group B.V. is owned by Fiserv Inc. (NYSE: FI, Milwaukee, Wisconsin), a major US financial technology company, so while the product team and operations are European, the ultimate beneficial owner is a US public company, creating material CLOUD Act exposure. Best fit for Dutch and Belgian SMBs who want a fully-managed, no-commission hosted shop with local Dutch-language support and local payment integrations. For buyers requiring clean EU ownership, Shopware Community Edition or PrestaShop self-hosted are stronger alternatives.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of CCV Shop
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicewww.ccvshop.nl/algemene-voorwaarden…
Alternatives in this category
-
Germany · €600/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
France · €24/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
PolandEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Shopware
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€600/mo |
PrestaShop
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€24/mo |
Sylius
Poland
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
— |