Business

Subprocessors

Version: technical-overview-2026-11-05
Effective date: Not established
Last updated: 2026-11-05

This is an informational technical overview based on the reviewed implementation. It is not a contractual schedule, certification or confirmation that every capability is active in production.

Inventory status

This inventory identifies services found in the implementation, reviewed on 5 November 2026. Each supplier’s role depends on purpose, actual configuration and contract. Request the approved subprocessor schedule applicable to your agreement. This inventory does not authorise new subprocessors.

DigitalOcean — infrastructure

Infrastructure documentation identifies DigitalOcean for platform hosting and related storage and databases. This can involve organisation, account and reservation data, logs and backups. One production cluster is documented in Amsterdam; this does not establish all storage, backup and support locations. Contracting entity, processing terms and any international transfer mechanisms require confirmation.

Sentry — error reporting

The APIs and several interfaces include Sentry integration with error-reporting filters. Error context can contain technical information and personal data despite filtering. Active configuration, contracting entity, processing locations and applicable transfer safeguards require confirmation.

Brevo — transactional email

Integration code includes Brevo for ticket and reservation email. The public website also documents Brevo SMTP for form messages with a separate approval control. Recipients, message content and delivery events may be processed. Active services, contracting entity, locations and safeguards require confirmation per activity.

OpenAI — conditional AI functionality

The Novi runtime includes a selectable OpenAI connection. When activated, conversation content, context and tool results may be processed. The selected provider, project, data categories, retention, location and contractual authorisation require confirmation for the deployment. An API storage setting does not establish that the provider retains no data.

Firebase — conditional push notifications

The My guest app includes Firebase Cloud Messaging for user-enabled push notifications. Device or notification identifiers and message information may be processed. Responsibilities, supplier contracts, active projects, locations and retention require confirmation per purpose. OS notification permission does not automatically constitute marketing consent.

Payment services and customer integrations

Mollie, Stripe and Rabobank payment integrations were found. Brevo Marketing, Mailchimp, Maileon and operational suppliers were found as customer-configurable integrations. Depending on the relationship they may be independent controllers, customer-appointed recipients or subprocessors. Code presence alone does not establish that role or an active transfer.

Changes and transfers

Subprocessor authorisation, objection procedures and change notices follow the applicable data processing agreement. Transfers outside the EEA require an applicable GDPR mechanism and, where necessary, further assessment and safeguards. This technical inventory does not verify the current contractual evidence.

Use your browser’s Print command to print this page or save it as a PDF.