[{"data":1,"prerenderedAt":691},["ShallowReactive",2],{"legal-sub-processors":3},{"id":4,"title":5,"body":6,"description":681,"effectiveDate":682,"extension":683,"lastUpdated":684,"meta":685,"navigation":686,"path":687,"seo":688,"stem":689,"__hash__":690},"legal\u002Flegal\u002Fsub-processors.md","Sub-processor List",{"type":7,"value":8,"toc":663},"minimark",[9,14,24,27,31,34,39,172,180,184,218,221,225,275,278,282,350,353,357,391,395,398,544,548,551,617,620,623,626,630,633,637,640,644,652,655],[10,11,13],"h2",{"id":12},"schedule-to-the-data-processing-agreement","Schedule to the Data Processing Agreement",[15,16,17,18,23],"p",{},"This Sub-processor List forms a schedule to the ",[19,20,22],"a",{"href":21},"\u002Flegal\u002Fdpa","Data Processing Agreement"," (\"DPA\") between Tourbox Systems Limited (company number 15613075), registered at 125 Freshfield Road, Brighton, England, BN2 0BR (\"Tourbox\", \"we\", \"us\") and the Customer (\"you\", \"Controller\").",[15,25,26],{},"Capitalised terms not defined here have the meanings given in the DPA.",[10,28,30],{"id":29},"current-sub-processors","Current Sub-processors",[15,32,33],{},"The following sub-processors are authorised to process personal data on behalf of Tourbox in connection with the provision of the platform:",[35,36,38],"h3",{"id":37},"core-platform-infrastructure","Core Platform Infrastructure",[40,41,42,61],"table",{},[43,44,45],"thead",{},[46,47,48,52,55,58],"tr",{},[49,50,51],"th",{},"Sub-processor",[49,53,54],{},"Purpose",[49,56,57],{},"Data Processed",[49,59,60],{},"Location",[62,63,64,84,101,119,136,154],"tbody",{},[46,65,66,75,78,81],{},[67,68,69],"td",{},[19,70,74],{"href":71,"rel":72},"https:\u002F\u002Fwww.hanko.io",[73],"nofollow","Hanko (Hanko GmbH)",[67,76,77],{},"Passwordless authentication",[67,79,80],{},"Email addresses, user identity, WebAuthn credentials",[67,82,83],{},"🇪🇺 EU",[46,85,86,93,96,99],{},[67,87,88],{},[19,89,92],{"href":90,"rel":91},"https:\u002F\u002Fnorthflank.com",[73],"Northflank (Northflank Ltd)",[67,94,95],{},"Infrastructure hosting (API, workers, database, Redis, monitoring)",[67,97,98],{},"All platform data",[67,100,83],{},[46,102,103,110,113,116],{},[67,104,105],{},[19,106,109],{"href":107,"rel":108},"https:\u002F\u002Fwww.ovhcloud.com",[73],"OVHcloud (OVH Groupe SAS)",[67,111,112],{},"Object storage (uploaded media, generated PDFs, attachments)",[67,114,115],{},"Traveller media, documents, passport images, attachments",[67,117,118],{},"🇫🇷 EU (France)",[46,120,121,128,131,134],{},[67,122,123],{},[19,124,127],{"href":125,"rel":126},"https:\u002F\u002Fwww.scaleway.com",[73],"Scaleway (Scaleway SAS)",[67,129,130],{},"Encrypted off-site backups",[67,132,133],{},"Client-side encrypted backup ciphertext only",[67,135,118],{},[46,137,138,145,148,151],{},[67,139,140],{},[19,141,144],{"href":142,"rel":143},"https:\u002F\u002Fwww.cloudflare.com",[73],"Cloudflare (Cloudflare, Inc.)",[67,146,147],{},"CDN, Pages hosting, DNS, Turnstile bot protection (transit only)",[67,149,150],{},"Static assets, IP addresses, form metadata (no data at rest)",[67,152,153],{},"🌍 Global",[46,155,156,163,166,169],{},[67,157,158],{},[19,159,162],{"href":160,"rel":161},"https:\u002F\u002Fwww.paddle.com",[73],"Paddle (Paddle.com Market Ltd)",[67,164,165],{},"Subscription billing, invoicing, tax compliance (Merchant of Record)",[67,167,168],{},"Billing data, organisation details, payment information",[67,170,171],{},"🇬🇧\u002F🇺🇸 UK\u002FUS",[15,173,174,175,179],{},"Error monitoring is performed by a ",[176,177,178],"strong",{},"self-hosted"," error-tracking service running on Tourbox's own Northflank (EU) infrastructure; it is not a separate third-party sub-processor, and personal data in error reports is disabled by default.",[35,181,183],{"id":182},"email-delivery","Email Delivery",[40,185,186,198],{},[43,187,188],{},[46,189,190,192,194,196],{},[49,191,51],{},[49,193,54],{},[49,195,57],{},[49,197,60],{},[62,199,200],{},[46,201,202,209,212,215],{},[67,203,204],{},[19,205,208],{"href":206,"rel":207},"https:\u002F\u002Fwww.mailgun.com",[73],"Mailgun (Sinch)",[67,210,211],{},"Outbound email delivery",[67,213,214],{},"Email addresses, email content",[67,216,217],{},"🇪🇺 EU (api.eu.mailgun.net)",[15,219,220],{},"Where an organisation configures its own SMTP server (see Operator-Initiated Integrations), outbound email for that organisation is sent via that operator-controlled server instead.",[35,222,224],{"id":223},"ai-providers","AI Providers",[40,226,227,239],{},[43,228,229],{},[46,230,231,233,235,237],{},[49,232,51],{},[49,234,54],{},[49,236,57],{},[49,238,60],{},[62,240,241,258],{},[46,242,243,250,253,256],{},[67,244,245],{},[19,246,249],{"href":247,"rel":248},"https:\u002F\u002Fmistral.ai",[73],"Mistral AI (Mistral AI SAS)",[67,251,252],{},"Text generation, document OCR, classification (default)",[67,254,255],{},"Document content, itinerary\u002Fbooking text",[67,257,83],{},[46,259,260,267,270,273],{},[67,261,262],{},[19,263,266],{"href":264,"rel":265},"https:\u002F\u002Fjina.ai",[73],"Jina AI \u002F Elastic",[67,268,269],{},"Text and image (multimodal) embeddings",[67,271,272],{},"Text and image content submitted for search",[67,274,83],{},[15,276,277],{},"Tourbox processes UK\u002FEU customer personal data only through EU-based AI sub-processors (Mistral AI and Jina AI). Web-search tooling used by the AI assistant receives only generic, non-identifying queries (no customer names, emails, booking references, or other personal data) and therefore does not process personal data on the Customer's behalf.",[35,279,281],{"id":280},"media-processing","Media Processing",[40,283,284,296],{},[43,285,286],{},[46,287,288,290,292,294],{},[49,289,51],{},[49,291,54],{},[49,293,57],{},[49,295,60],{},[62,297,298,316,333],{},[46,299,300,307,310,313],{},[67,301,302],{},[19,303,306],{"href":304,"rel":305},"https:\u002F\u002Fwww.mux.com",[73],"Mux (Mux, Inc.)",[67,308,309],{},"Video encoding, storage and signed playback",[67,311,312],{},"Video media",[67,314,315],{},"🇺🇸 US",[46,317,318,325,328,331],{},[67,319,320],{},[19,321,324],{"href":322,"rel":323},"https:\u002F\u002Ffal.ai",[73],"fal.ai (FAL AI, Inc.)",[67,326,327],{},"AI image upscaling, retouch, image-to-video, image edit",[67,329,330],{},"Image and video media",[67,332,315],{},[46,334,335,342,345,348],{},[67,336,337],{},[19,338,341],{"href":339,"rel":340},"https:\u002F\u002Fwww.runpod.io",[73],"RunPod (RunPod, Inc.)",[67,343,344],{},"GPU vision (object detection, captioning, alt-text)",[67,346,347],{},"Image media",[67,349,315],{},[15,351,352],{},"These media sub-processors process uploaded media files (which may contain images of identifiable individuals). They are engaged under a Data Processing Agreement with appropriate transfer safeguards (UK IDTA \u002F EU SCCs).",[35,354,356],{"id":355},"maps-geocoding","Maps & Geocoding",[40,358,359,371],{},[43,360,361],{},[46,362,363,365,367,369],{},[49,364,51],{},[49,366,54],{},[49,368,57],{},[49,370,60],{},[62,372,373],{},[46,374,375,382,385,388],{},[67,376,377],{},[19,378,381],{"href":379,"rel":380},"https:\u002F\u002Fwww.maptiler.com",[73],"MapTiler (MapTiler AG)",[67,383,384],{},"Maps, geocoding",[67,386,387],{},"Location queries, coordinates",[67,389,390],{},"🇨🇭 EU-adequate (CH)",[35,392,394],{"id":393},"operator-initiated-integrations","Operator-Initiated Integrations",[15,396,397],{},"These sub-processors are only engaged when an authorised operator within the Customer's organisation explicitly connects the relevant integration:",[40,399,400,412],{},[43,401,402],{},[46,403,404,406,408,410],{},[49,405,51],{},[49,407,54],{},[49,409,57],{},[49,411,60],{},[62,413,414,432,450,467,480,497,512,527],{},[46,415,416,423,426,429],{},[67,417,418],{},[19,419,422],{"href":420,"rel":421},"https:\u002F\u002Fwww.vamoos.com",[73],"Vamoos (Vamoos Ltd)",[67,424,425],{},"Sync itineraries \u002F travel documents to the Vamoos traveller app",[67,427,428],{},"Traveller itineraries and documents",[67,430,431],{},"🇬🇧 UK",[46,433,434,441,444,447],{},[67,435,436],{},[19,437,440],{"href":438,"rel":439},"https:\u002F\u002Fwww.xero.com",[73],"Xero (Xero Limited)",[67,442,443],{},"Accounting sync (supplier invoices, payments)",[67,445,446],{},"Supplier and financial transaction data",[67,448,449],{},"🇦🇺 AU\u002FGlobal",[46,451,452,459,462,465],{},[67,453,454],{},[19,455,458],{"href":456,"rel":457},"https:\u002F\u002Fslack.com",[73],"Slack (Salesforce, Inc.)",[67,460,461],{},"Notifications posted to the operator's workspace",[67,463,464],{},"Notification \u002F event-summary content",[67,466,315],{},[46,468,469,472,475,477],{},[67,470,471],{},"SMTP (operator-configured)",[67,473,474],{},"Outbound email via the operator's own mail server",[67,476,214],{},[67,478,479],{},"Operator-controlled",[46,481,482,489,492,495],{},[67,483,484],{},[19,485,488],{"href":486,"rel":487},"https:\u002F\u002Fads.google.com",[73],"Google Ads (Google LLC)",[67,490,491],{},"Offline conversion upload",[67,493,494],{},"Advertising click identifiers, conversions",[67,496,315],{},[46,498,499,506,508,510],{},[67,500,501],{},[19,502,505],{"href":503,"rel":504},"https:\u002F\u002Fads.microsoft.com",[73],"Microsoft Ads (Microsoft Corporation)",[67,507,491],{},[67,509,494],{},[67,511,315],{},[46,513,514,521,523,525],{},[67,515,516],{},[19,517,520],{"href":518,"rel":519},"https:\u002F\u002Fwww.facebook.com\u002Fbusiness",[73],"Meta Ads (Meta Platforms, Inc.)",[67,522,491],{},[67,524,494],{},[67,526,315],{},[46,528,529,536,539,542],{},[67,530,531],{},[19,532,535],{"href":533,"rel":534},"https:\u002F\u002Fwww.felloh.com",[73],"Felloh (Felloh Ltd)",[67,537,538],{},"Payment processing (card \u002F open banking) and reconciliation",[67,540,541],{},"Customer name, email, travel dates, booking reference, payment amounts",[67,543,431],{},[35,545,547],{"id":546},"connected-accounts-user-initiated","Connected Accounts (User-Initiated)",[15,549,550],{},"These sub-processors are engaged only when an individual user connects their own account via OAuth:",[40,552,553,565],{},[43,554,555],{},[46,556,557,559,561,563],{},[49,558,51],{},[49,560,54],{},[49,562,57],{},[49,564,60],{},[62,566,567,584,600],{},[46,568,569,576,579,582],{},[67,570,571],{},[19,572,575],{"href":573,"rel":574},"https:\u002F\u002Fwww.google.com",[73],"Google (Google LLC)",[67,577,578],{},"Gmail synchronisation",[67,580,581],{},"User mailbox content, identity",[67,583,315],{},[46,585,586,593,596,598],{},[67,587,588],{},[19,589,592],{"href":590,"rel":591},"https:\u002F\u002Fwww.microsoft.com",[73],"Microsoft (Microsoft Corporation)",[67,594,595],{},"Outlook \u002F Microsoft Graph mail sync",[67,597,581],{},[67,599,315],{},[46,601,602,609,612,615],{},[67,603,604],{},[19,605,608],{"href":606,"rel":607},"https:\u002F\u002Fzoom.us",[73],"Zoom (Zoom Video Communications, Inc.)",[67,610,611],{},"Meeting \u002F call data",[67,613,614],{},"Meeting data, participant information",[67,616,315],{},[15,618,619],{},"The Customer (or the relevant user) may disconnect any operator-initiated integration or connected account at any time, at which point data sharing with that sub-processor ceases. No personal data is shared with these sub-processors unless and until the integration is actively enabled.",[15,621,622],{},"Some optional integrations do not transmit personal data: stock-image search (Unsplash, Pexels) sends only non-identifying search terms, and the WordPress plugin operates on the operator's own self-hosted site. These are therefore not personal-data sub-processors.",[15,624,625],{},"The Felloh Data Processing Agreement is to be confirmed and signed out of band before the payments feature goes live; the entry above is recorded here so the sub-processor list stays complete.",[10,627,629],{"id":628},"ai-provider-selection","AI Provider Selection",[15,631,632],{},"All AI processing of UK\u002FEU customer personal data is performed by EU-based sub-processors. Text generation, OCR and classification use Mistral AI (France); embeddings use Jina AI (Germany \u002F Elastic). US-based AI providers are not used for customer personal data.",[10,634,636],{"id":635},"notification-of-changes","Notification of Changes",[15,638,639],{},"In accordance with the DPA, Tourbox will provide the Customer with at least 14 days' prior written notice of any intended changes to this Sub-processor List, including the addition or replacement of sub-processors. The Customer may object to such changes as set out in the DPA.",[10,641,643],{"id":642},"contact","Contact",[15,645,646,647,651],{},"If you have any questions about this Sub-processor List or our use of sub-processors, please contact us at ",[19,648,650],{"href":649},"mailto:support@tourbox.com","support@tourbox.com",".",[653,654],"hr",{},[15,656,657],{},[658,659,660,661,651],"em",{},"This Sub-processor List was last updated on the date shown in the page metadata above. See also our ",[19,662,22],{"href":21},{"title":664,"searchDepth":665,"depth":665,"links":666},"",2,[667,668,678,679,680],{"id":12,"depth":665,"text":13},{"id":29,"depth":665,"text":30,"children":669},[670,672,673,674,675,676,677],{"id":37,"depth":671,"text":38},3,{"id":182,"depth":671,"text":183},{"id":223,"depth":671,"text":224},{"id":280,"depth":671,"text":281},{"id":355,"depth":671,"text":356},{"id":393,"depth":671,"text":394},{"id":546,"depth":671,"text":547},{"id":628,"depth":665,"text":629},{"id":635,"depth":665,"text":636},{"id":642,"depth":665,"text":643},"Current list of sub-processors engaged by Tourbox Systems Limited to process personal data under the Data Processing Agreement.","2026-06-01","md","2026-06-17",{},true,"\u002Flegal\u002Fsub-processors",{"title":5,"description":681},"legal\u002Fsub-processors","a96JbMeUsTgzse67mSWu-PfALeH4h14k6Nu0LjAHjx4",1782308036997]