SUB-PROCESSORS
Vezpa - Property Management System
List pursuant to art. 28.4 GDPR
Last updated: 2 November 2026
📌 Legal precedence: this document is a courtesy translation of the Italian original. In case of any discrepancy between this translation and the Italian version, the Italian version shall prevail as the legally binding reference. Italian original available here: https://vezpa.it/subprocessors/.
Purpose of this page: it lists the providers (sub-processors) that Vezpa uses to deliver the service, each with location, purpose and legal basis for data transfer. The list is an integral part of the Data Processing Agreement.
Prior notice of changes: any additions or replacements are communicated to Data Controllers (customer facilities) with at least 30 days' notice by email and dashboard, allowing the exercise of the right to object (art. 28.2 GDPR).
1. Active sub-processors
1.1 Infrastructure and storage
| Provider | Location | Purpose | Data processed | Transfer basis |
|---|---|---|---|---|
| DigitalOcean LLC 101 Ave of the Americas, New York, NY 10013, USA |
EU servers (Frankfurt - FRA1) + USA headquarters | Hosting servers, PostgreSQL database, Redis, Spaces object storage, CDN | All platform data | EU DPF SCC as fallback |
1.2 Payments
| Provider | Location | Purpose | Data processed | Transfer basis |
|---|---|---|---|---|
| Stripe Payments Europe Ltd 1 Grand Canal Street Lower, Dublin, Ireland (with Stripe Inc., San Francisco, CA, USA) |
EU (IE) + USA | Card payment processing, anti-fraud, guest payment links | Card data (managed by Stripe, not stored by Vezpa), email, amount, reference booking | EU DPF |
1.3 Communications
| Provider | Location | Purpose | Data processed | Transfer basis |
|---|---|---|---|---|
| IONOS SE Elgendorfer Str. 57, 56410 Montabaur, Germany |
EU (DE) | Transactional emails, vezpa.it email server, PEC | Recipient email address, email content, metadata | EU |
| Sendinblue SAS (Brevo) 106 boulevard Haussmann, 75008 Paris, France |
EU (FR) | Sending transactional emails (SMTP); receiving the emails guests write to the property's @ospiti.vezpa.it address, only if the property turns on «Guest emails» | Email address and name of sender and recipient, subject, content and attachment names of the emails, metadata | EU |
| Google LLC - Firebase Cloud Messaging 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA (via Google Ireland Ltd) |
EU (IE) + USA | Sending push notifications to mobile and desktop devices | Device FCM token, technical identifiers, notification payload (booking metadata only, no sensitive PII) | EU DPF |
| Google LLC - Google Cloud Translation API 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA (via Google Ireland Ltd) |
EU (IE) + USA (processing location not restricted to the EU) |
Automatic translation, for the host, of messages written by guests through OTA channels; suggested translation of the names and descriptions of paid extras, only when the host presses «Translate into the other languages» | Text of the guest's message (may contain personal data written by the guest), names and descriptions of extras, source and target language codes. No other data: the message is sent without name, contact details or booking data | EU DPF |
1.4 OTA Channel Manager
| Provider | Location | Purpose | Data processed | Transfer basis |
|---|---|---|---|---|
| STAAH Limited Auckland, New Zealand |
New Zealand | Synchronisation of bookings, availability and rates with ~60 OTA channels | Booking data (guest name, dates, room, rate, contacts) | EU Adequacy (Decision 2013/65/EU) |
1.5 In-app purchase and app distribution
| Provider | Location | Purpose | Data processed | Transfer basis |
|---|---|---|---|---|
| Apple Distribution International Ltd Hollyhill Industrial Estate, Hollyhill, Cork, Ireland (with Apple Inc., Cupertino, CA, USA) |
EU (IE) + USA | App Store iOS/macOS distribution, subscription management (StoreKit) | Store account ID, purchase token, subscription status | EU SCC — Apple does not participate in the DPF; USA transfers are governed by SCC 2021/914 |
| Google Ireland Ltd / Google LLC Gordon House, Barrow Street, Dublin 4, Ireland (with Google LLC, USA) |
EU (IE) + USA | Play Store Android distribution, subscription management (Play Billing) | Store account ID, purchase token, subscription status | EU DPF |
| Microsoft Ireland Operations Ltd / Microsoft Corp. One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland |
EU (IE) + USA | Microsoft Store Windows distribution, subscription management | Store account ID, subscription status | EU DPF |
1.6 Optional integrations (only if activated by the facility)
| Provider | Location | Purpose | Data processed | Transfer basis |
|---|---|---|---|---|
| Tuya Smart (Hangzhou Tuya Information Technology Co., Ltd.) Hangzhou, China |
China | Management of smart locks and home automation | Device identifiers, access events | SCC Optional |
| Anthropic, PBC 548 Market Street, PMB 90375, San Francisco, CA 94104, USA |
USA | Replies to guest messages with an artificial intelligence model (Claude), only if the property turns on «Assistant replies»: the reply is sent on its own when the assistant has all the information; in delicate cases it stays a draft for the host | Text of the conversation with the guest, guest name and language, property details and host notes, dates and amounts of the linked booking | SCC Optional |
| Meta Platforms Ireland Limited (WhatsApp Business Platform) Merrion Road, Dublin 4, D04 X2K5, Ireland |
EU (IE) + USA | Receiving and sending WhatsApp messages between the property and its guests, only if the property connects its own WhatsApp Business number; the property accepts the WhatsApp Business terms directly with Meta; any transfers to Meta Platforms, Inc. (USA) take place under SCC | Guest's phone number and WhatsApp profile name, message text and attachments | SCC Optional |
Services that the property chooses and connects itself, such as the voice platform that answers the phone (e.g. Retell, Vapi, ElevenLabs), are not sub-processors of Vezpa: they are providers of the property, which is responsible for them.
2. Independent Data Controller recipients
The following parties are not sub-processors but independent Data Controllers that receive data for legal obligations or their own relationship with the data subject. They are listed here for transparency:
2.1 Public authorities (legal obligation of the Controller)
- Italy: AlloggiatiWeb (Italian State Police, via the local police office, the Questura), ISTAT, Italian municipalities (via PayTourist), Italian Revenue Agency (Interchange System - SDI)
- Austria: Feratel / Meldeamt (municipal guest registration)
- Spain: SES.HOSPEDAJES (Ministerio del Interior)
- Hungary: NTAK (Nemzeti Turisztikai Adatszolgáltató Központ)
- Croatia: eVisitor
- Portugal: SEF (Serviço de Estrangeiros e Fronteiras)
- Czech Republic: UbyPort
- Slovenia: eTurizem / AJPES
Governmental connectors are activated only if the facility is located in the corresponding State. Connection credentials are configured by the facility itself; Vezpa does not store credentials in clear text.
2.2 OTAs and metasearch (contractual relationship with the traveller)
The OTA channels activated by the facility receive booking and inventory data. They fall into the category:
- Main (legacy): Booking.com, Airbnb, Expedia, VRBO, Agoda
- ~60 other dynamic channels via STAAH: e.g. Hotels.com, Trip.com, Hostelworld, Despegar, etc.
Each OTA applies its own privacy notice. Transfers to OTAs outside the EU are governed by their direct contracts with the facility and/or with the traveller.
3. Legend
- EU - Office or branch in the European Union
- DPF - Active EU-U.S. Data Privacy Framework certification
- EU Adequacy - Country with adequacy decision of the European Commission
- SCC - EU Standard Contractual Clauses 2021/914
- Optional - Activated only upon explicit choice of the facility
4. Change history
| Date | Change |
|---|---|
| 19 April 2026 | First publication of the public list |
| 9 October 2026 | Added Google LLC - Google Cloud Translation API (translation of guest messages and extras) |
| 30 October 2026 | Added Sendinblue SAS (Brevo): sending of transactional emails and receipt of guest emails |
| 1 November 2026 | Added Anthropic, PBC: replies to guest messages (AI assistant, optional) |
| 2 November 2026 | Added Meta Platforms Ireland Limited (WhatsApp Business Platform): guest WhatsApp messages (optional) |
Contact
For questions about sub-processors or to object to a change:
info@vezpa.it
PEC: lavezpa@pec.it