SUB-PROCESSORS
Vezpa - Property Management System
List under GDPR art. 28.4 / PIPEDA third parties
Last updated: November 2, 2026
📌 Legal precedence: this document is a courtesy translation of the Italian original. In case of any discrepancy between this translation and the Italian version, the Italian version shall prevail as the legally binding reference. Italian original available here: https://vezpa.it/subprocessors/.
Purpose of this page: it lists the providers (sub-processors / third parties) that Vezpa uses to deliver the service, each with location, purpose and legal basis for the transfer of data. This list is an integral part of the Data Processing Agreement.
Notice of change: any addition or replacement is communicated to the Data Controllers / Organizations (customer properties) with at least 30 days' notice by email and dashboard, allowing the right to object (GDPR art. 28.2; equivalent rights under PIPEDA and Quebec Law 25).
1. Active Sub-processors
1.1 Infrastructure and Storage
| Provider | Location | Purpose | Data processed | Transfer basis |
|---|---|---|---|---|
| DigitalOcean LLC 101 Ave of the Americas, New York, NY 10013, USA |
EU servers (Frankfurt - FRA1) + USA headquarters | Server hosting, PostgreSQL database, Redis, Spaces object storage, CDN | All platform data | EU DPF SCCs as fallback |
1.2 Payments
| Provider | Location | Purpose | Data processed | Transfer basis |
|---|---|---|---|---|
| Stripe Payments Europe Ltd 1 Grand Canal Street Lower, Dublin, Ireland (with Stripe Inc., San Francisco, CA, USA) |
EU (IE) + USA | Card payment processing, anti-fraud, guest payment links | Card data (handled by Stripe, not stored by Vezpa), email, amount, reference reservation | EU DPF |
1.3 Communications
| Provider | Location | Purpose | Data processed | Transfer basis |
|---|---|---|---|---|
| IONOS SE Elgendorfer Str. 57, 56410 Montabaur, Germany |
EU (DE) | Transactional emails, vezpa.it email server, PEC | Recipient email address, email content, metadata | EU |
| Sendinblue SAS (Brevo) 106 boulevard Haussmann, 75008 Paris, France |
EU (FR) | Sending transactional emails (SMTP); receiving the emails guests write to the property's @ospiti.vezpa.it address, only if the property turns on «Guest emails» | Email address and name of sender and recipient, subject, content and attachment names of the emails, metadata | EU |
| Google LLC - Firebase Cloud Messaging 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA (via Google Ireland Ltd) |
EU (IE) + USA | Sending push notifications to mobile and desktop devices | Device FCM token, technical identifiers, notification payload (only reservation metadata, no sensitive PII) | EU DPF |
| Google LLC - Google Cloud Translation API 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA (via Google Ireland Ltd) |
EU (IE) + USA (processing location not restricted to the EU) |
Automatic translation, for the host, of messages written by guests through OTA channels; suggested translation of the names and descriptions of paid extras, only when the host presses «Translate into the other languages» | Text of the guest's message (may contain personal data written by the guest), names and descriptions of extras, source and target language codes. No other data: the message is sent without name, contact details or booking data | EU DPF |
1.4 OTA Channel Manager
| Provider | Location | Purpose | Data processed | Transfer basis |
|---|---|---|---|---|
| STAAH Limited Auckland, New Zealand |
New Zealand | Synchronization of reservations, availability and rates with ~60 OTA channels | Reservation data (guest name, dates, room, rate, contacts) | EU Adequacy (Decision 2013/65/EU) |
1.5 In-app Purchase and App Distribution
| Provider | Location | Purpose | Data processed | Transfer basis |
|---|---|---|---|---|
| Apple Distribution International Ltd Hollyhill Industrial Estate, Hollyhill, Cork, Ireland (with Apple Inc., Cupertino, CA, USA) |
EU (IE) + USA | Distribution on App Store iOS/macOS, subscription management (StoreKit) | Store account ID, purchase token, subscription status | EU SCC - Apple does not participate in the DPF; USA transfers are governed by SCC 2021/914 |
| Google Ireland Ltd / Google LLC Gordon House, Barrow Street, Dublin 4, Ireland (with Google LLC, USA) |
EU (IE) + USA | Distribution on Play Store Android, subscription management (Play Billing) | Store account ID, purchase token, subscription status | EU DPF |
| Microsoft Ireland Operations Ltd / Microsoft Corp. One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland |
EU (IE) + USA | Distribution on Microsoft Store Windows, subscription management | Store account ID, subscription status | EU DPF |
1.6 Optional Integrations (only if activated by the property)
| Provider | Location | Purpose | Data processed | Transfer basis |
|---|---|---|---|---|
| Tuya Smart (Hangzhou Tuya Information Technology Co., Ltd.) Hangzhou, China |
China | Smart lock and home automation management | Device identifiers, access events | SCC Optional |
| Anthropic, PBC 548 Market Street, PMB 90375, San Francisco, CA 94104, USA |
USA | Replies to guest messages with an artificial intelligence model (Claude), only if the property turns on «Assistant replies»: the reply is sent on its own when the assistant has all the information; in delicate cases it stays a draft for the host | Text of the conversation with the guest, guest name and language, property details and host notes, dates and amounts of the linked booking | SCC Optional |
| Meta Platforms Ireland Limited (WhatsApp Business Platform) Merrion Road, Dublin 4, D04 X2K5, Ireland |
EU (IE) + USA | Receiving and sending WhatsApp messages between the property and its guests, only if the property connects its own WhatsApp Business number; the property accepts the WhatsApp Business terms directly with Meta; any transfers to Meta Platforms, Inc. (USA) take place under SCC | Guest's phone number and WhatsApp profile name, message text and attachments | SCC Optional |
Services that the property chooses and connects itself, such as the voice platform that answers the phone (e.g. Retell, Vapi, ElevenLabs), are not sub-processors of Vezpa: they are providers of the property, which is responsible for them.
2. Recipients as Independent Data Controllers
The following entities are not sub-processors but independent Data Controllers / Organizations that receive data for legal obligations or for their own relationship with the individual. They are listed here for transparency:
2.1 Public Authorities (legal obligation of the Controller)
- Italy: AlloggiatiWeb (Italian State Police, via the local police office, the Questura), ISTAT, Italian Municipalities (via PayTourist), Italian Revenue Agency (Interchange System - SDI)
- Austria: Feratel / Meldeamt (municipal guest registration)
- Spain: SES.HOSPEDAJES (Ministerio del Interior)
- Hungary: NTAK (Nemzeti Turisztikai Adatszolgáltató Központ)
- Croatia: eVisitor
- Portugal: SEF (Serviço de Estrangeiros e Fronteiras)
- Czech Republic: UbyPort
- Slovenia: eTurizem / AJPES
- Canada: Canada Revenue Agency (CRA), provincial tax authorities and law enforcement where required by law
Government connectors are activated only if the property is located in the corresponding jurisdiction. Connection credentials are configured by the property itself; Vezpa does not store credentials in plaintext.
2.2 OTAs and Metasearch (contractual relationship with the traveller)
OTA channels activated by the property receive reservation and inventory data. They fall into the category:
- Main (legacy): Booking.com, Airbnb, Expedia, VRBO, Agoda
- ~60 other dynamic channels via STAAH: e.g. Hotels.com, Trip.com, Hostelworld, Despegar, etc.
Each OTA applies its own privacy notice. Transfers to OTAs outside the EU/Canada are governed by their direct contracts with the property and/or with the traveller.
3. Legend
- EU - Office or branch in the European Union
- DPF - Active EU-U.S. Data Privacy Framework certification
- EU Adequacy - Country with European Commission adequacy decision
- SCC - EU Standard Contractual Clauses 2021/914
- Optional - Activated only upon explicit choice of the property
4. Change Log
| Date | Change |
|---|---|
| April 19, 2026 | First publication of the public list |
| October 9, 2026 | Added Google LLC - Google Cloud Translation API (translation of guest messages and extras) |
| October 30, 2026 | Added Sendinblue SAS (Brevo): sending of transactional emails and receipt of guest emails |
| November 1, 2026 | Added Anthropic, PBC: replies to guest messages (AI assistant, optional) |
| November 2, 2026 | Added Meta Platforms Ireland Limited (WhatsApp Business Platform): guest WhatsApp messages (optional) |
Contact
For questions about sub-processors or to object to a change:
info@vezpa.it
PEC: lavezpa@pec.it
Canadian Organizations may also contact the Office of the Privacy Commissioner of Canada - OPC (www.priv.gc.ca (opens in a new tab)). Quebec Organizations may contact the Commission d'accès à l'information (CAI, www.cai.gouv.qc.ca (opens in a new tab)).