ALiSiO Subprocessors
Annex 3 to the ALiSiO Data Processing Agreement · Version 1.0 · effective {{EFFECTIVE_DATE}}
{{PROVIDER_NAME}} ("Provider") engages the following subprocessors to provide the ALiSiO service. Each subprocessor is bound by a data processing agreement with obligations equivalent to the ALiSiO DPA.
Changes. We announce every new or replaced subprocessor at least 30 days in advance by email to the notification address of each Customer and by a notice in the Service. Anyone can subscribe to these notices on this page. Customers may object as described in Section 6 of the DPA.
A. Used for every Customer
| Subprocessor | Purpose | Data concerned | Location of processing | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Hosting of the application and the database | All Customer Data | Germany | Within the EU |
| Backblaze, Inc., San Mateo, CA, USA | Storage of encrypted off-site backups | All Customer Data, encrypted before transfer; the subprocessor has no key | European Union (region {{B2_REGION}}) | Data stored in the EU; standard contractual clauses for any access from outside the EEA |
| {{SMTP_PROVIDER}} | Sending of emails of the Service (booking confirmations, reminders, notices) | Recipient address, content of the email | {{SMTP_LOCATION}} | {{SMTP_SAFEGUARD}} |
| Functional Software, Inc. (Sentry), San Francisco, CA, USA | Error monitoring of the application | Technical data of errors, which may include a User identifier or IP address | European Union (Germany) | Data stored in the EU; EU–U.S. Data Privacy Framework / standard contractual clauses |
| OpenAI Ireland Ltd, Dublin, Ireland (processing by OpenAI, L.L.C., USA) | Machine translation of the Customer's own texts (for example guest page, room types, services) into the guests' languages | Texts entered by the Customer; no guest data | USA | EU–U.S. Data Privacy Framework / standard contractual clauses |
| Google Ireland Limited, Dublin, Ireland (Google Workspace) | Email communication with Customers, support | Content of emails the Customer sends to support | European Union / USA | EU–U.S. Data Privacy Framework / standard contractual clauses |
| Anthropic, PBC, San Francisco, CA, USA | AI assistance for support cases and for migrating data from a previous system, only at the Customer's request | Data the Customer provides for the support case or migration | USA | Standard contractual clauses; data not used for training |
B. Used only if the Customer activates the function
| Subprocessor | Function | Data concerned | Location of processing | Transfer safeguard |
|---|---|---|---|---|
| OpenAI Ireland Ltd, Dublin, Ireland (processing by OpenAI, L.L.C., USA) | Cloud document recognition: reading data from a photo of a guest's identity document. Off by default; switched on by the Customer in the settings | Image of the identity document and the data read from it; the image is not stored permanently in ALiSiO | USA | EU–U.S. Data Privacy Framework / standard contractual clauses |
| Channex.io Ltd, United Kingdom | Channel manager: exchange of availability, rates and reservations with online travel agencies | Reservation and guest data of bookings made through channels | United Kingdom | Adequacy decision of the European Commission for the United Kingdom |
C. Not subprocessors
Services the Customer contracts itself and connects to its Account — for example online travel agencies (Booking.com and others), payment service providers, fiscal or cash-register service providers, or the Customer's own email account — are recipients chosen by the Customer, not subprocessors of the Provider.
Change history
| Version | Date | Change |
|---|---|---|
| 1.0 | {{EFFECTIVE_DATE}} | First published list |