Subprocessor
A provider may act as a subprocessor where it processes relevant personal data on behalf of HotelConnect24 in a processing chain where HotelConnect24 itself acts as a processor.
HotelConnect24 Subprocessors
Know Who Supports the Platform. Transparency Across Our Service Providers.
HotelConnect24 can use specialised third-party providers to support infrastructure, communications, security and other platform functions. This page explains how subprocessors fit into the HotelConnect24 data protection framework and provides a register of relevant providers.
Third-Party Processing
Use Specialist Providers Without Losing Sight of Data Responsibility.
Transparency
HotelConnect24 Subprocessor Framework
Identify relevant providers, understand their purpose and keep the production register aligned with the services actually in use.
Review
Contract
Document
Update
Infrastructure Providers
Hosting and infrastructure services may process information required to operate HotelConnect24 systems.
Communication Providers
Email delivery infrastructure can process information necessary to send transactional or operational messages.
Security Providers
Selected external services may support anti-abuse, traffic protection or security-related workflows.
Operational Services
Additional specialist services may be added where they are required for an approved HotelConnect24 workflow.
Provider → Defined Purpose → Appropriate Access → Transparent Register
A provider should not receive broader access merely because its service could technically process more information.
Controlled
Defined Purpose
Understand why the provider is required
Relevant Access
Limit processing to the required service
Provider Review
Assess the relationship before production use
Public Register
Keep important processing dependencies visible
Understanding Subprocessors
Not Every Third Party Is Automatically a Subprocessor.
The role depends on what the third party does, whose instructions it follows and whether it processes relevant personal data on behalf of HotelConnect24 within the applicable processing relationship.
Independent Service Provider
Some third parties may determine their own purposes for particular processing activities rather than acting only on HotelConnect24 instructions. Their legal role can therefore differ.
External Integration Partner
A hotel, OTA, distribution business or technology partner can participate in a connected workflow without necessarily being a HotelConnect24 subprocessor. The relationship depends on the actual data flow.
Current Register
HotelConnect24 Subprocessor Register.
The register below identifies providers currently known to support HotelConnect24 services that can involve processing of relevant information. The exact processing depends on which service is enabled.
Provider
Service & Purpose
Potential Data Involved
Processing Context
Provider
Hetzner
Infrastructure and hosting services used for HotelConnect24 web or server workloads.
Infrastructure
Service & Purpose
Hosting & Server Infrastructure
Provides infrastructure required to operate relevant HotelConnect24 systems and public web services.
Potential Data Involved
Platform & Technical Data
Depending on the hosted service, this can include stored application information, server logs, request data and other information processed by the hosted workload.
Processing Context
European infrastructure used where configured
Provider
SMTP2GO
Email-delivery service used for configured HotelConnect24 transactional or operational email.
Email Delivery
Service & Purpose
Transactional Email Delivery
Supports sending relevant verification, operational, support or partner-related email where configured.
Potential Data Involved
Email & Message Data
Recipient email address, sender information, message content and delivery-related technical metadata as required for the email service.
Processing Context
EU service configuration used where applicable
Provider
Cloudflare
Security, anti-abuse or human-verification services where enabled for a HotelConnect24 workflow.
Security
Service & Purpose
Turnstile / Security Services
Can support bot protection, human-verification or other security-related functionality for selected public workflows.
Potential Data Involved
Request & Technical Data
Technical information associated with the security request may be processed according to the enabled Cloudflare service.
Processing Context
Where configured
Register note:
A provider's appearance on this page does not mean that every HotelConnect24
user's information is sent to that provider, nor that every service listed
is used in every workflow. Processing depends on the HotelConnect24 service,
technical configuration and applicable data flow. This register should be
updated whenever the production architecture changes materially.
Processing Relationships
Follow the Data Flow — Not Just the Vendor Name.
The same provider can have different legal and operational roles depending on the service being used. HotelConnect24 therefore needs to understand what information is processed, why it is processed and under whose instructions.
This is particularly important when HotelConnect24 processes data on behalf of a hotel and then uses another service provider to support that processing.
✓
Identify the purpose
Understand why the provider is needed for the HotelConnect24 service.
✓
Identify the data
Determine which information the provider can actually receive or access.
✓
Identify the role
Determine whether the provider acts as processor, subprocessor, independent controller or another role.
✓
Document the relationship
Relevant contractual and data-protection requirements should reflect the actual processing arrangement.
Illustrative Processing Chain
DATA FLOW
01
Hotel / Business Customer
Defines the applicable hotel service relationship
Customer
02
HotelConnect24
Provides the agreed platform or processing service
Platform
03
Required Provider
Supports a defined infrastructure or operational function
Provider
04
Limited Processing
Provider processes information required by its service
Purpose
05
Contractual Controls
Applicable terms govern the processing relationship
Control
International Processing
Provider Location and Data Location Are Not Always the Same Thing.
A technology provider can be headquartered in one country, operate infrastructure in another and use support or corporate systems across multiple jurisdictions.
HotelConnect24 should therefore evaluate relevant international data flows based on the actual service and contractual arrangement rather than relying only on the provider's brand address.
✓
Review service regions
Understand where relevant production services and data processing can occur.
✓
Review contractual safeguards
Where required, appropriate contractual transfer mechanisms should be considered.
✓
Prefer appropriate regional configuration
Where available and suitable, regional service configuration can help reduce unnecessary international processing.
✓
Keep the register current
Material changes to providers or processing locations should be reflected in the relevant documentation.
International Processing Review
Questions to consider before production use
01
Where Is the Service Hosted?
Identify the relevant infrastructure or service region.
02
Who Can Access the Data?
Consider provider personnel and service operations where relevant.
03
What Data Is Required?
Limit the provider's exposure to information needed for the service.
04
What Contract Applies?
Review the applicable processing and transfer terms.
05
Has the Register Been Updated?
Keep customer-facing information aligned with production reality.
Provider Review
A Useful Tool Is Not Automatically the Right Production Provider.
Before a service becomes part of a HotelConnect24 production workflow, its purpose, data access and operational importance should be understood.
Changes to Subprocessors
The Register Must Be Able to Change with the Platform.
HotelConnect24 may add, replace or remove service providers as the platform evolves. The production register should reflect material changes to relevant processing dependencies.
New Provider
A new provider may be introduced where HotelConnect24 requires a new service, improves the architecture or replaces an existing dependency.
Changed Processing
An existing provider's purpose, service region or data-processing scope may change as the HotelConnect24 implementation evolves.
Retired Provider
Providers should be removed from the active register when they no longer support the relevant HotelConnect24 processing activity.
Change notice:
Where a contract or applicable data-processing agreement requires
specific notice of a new subprocessor, that notice mechanism should
be handled according to the relevant agreement. Publication on this
page is intended to support transparency but does not replace a separately
required contractual notification process.
What Is Not Included
A Connected Business Is Not Necessarily a HotelConnect24 Subprocessor.
HotelConnect24 can connect with hotels, distribution platforms, technology providers and travel businesses that operate under their own independent roles and responsibilities.
Hotels
A participating hotel is not listed here merely because it exchanges reservation or property information with HotelConnect24.
Distribution Partners
OTAs, travel marketplaces and distribution businesses can have their own independent relationship with travellers and hotels.
Technology Partners
An integrated technology company is not automatically a subprocessor. Its role depends on the actual processing arrangement and data flow.
Practical Scope
The Register Should Follow Production Reality.
Infrastructure and integrations can change. A subprocessor page is useful only when it is maintained alongside the actual HotelConnect24 architecture.
Important:
This page provides general transparency regarding HotelConnect24
third-party service providers and subprocessors. The exact legal role
of a provider depends on the relevant processing activity, contractual
relationship and applicable law. A provider listed here may not process
data for every HotelConnect24 customer or service. Additional providers
may be used for specific products or configurations and should be added
to the register where required. Specific contractual obligations are
governed by the applicable HotelConnect24 agreement and Data Processing Agreement.
Subprocessor FAQ
Common Questions About HotelConnect24 Subprocessors.
What is a subprocessor?
A subprocessor is generally a third-party provider engaged by a processor
to process relevant personal data on behalf of that processor. The exact
role depends on the applicable processing relationship and contract.
Why does HotelConnect24 use external providers?
Specialist providers can support infrastructure, email delivery,
security and other technical functions that are needed to operate
HotelConnect24 services effectively.
Does every HotelConnect24 user send data to every provider listed here?
No. Processing depends on the service being used, technical configuration
and relevant workflow. A provider can be part of the HotelConnect24
architecture without receiving data from every user or property.
Does HotelConnect24 currently use Hetzner?
Hetzner infrastructure is used for relevant HotelConnect24 web or
server workloads in the current architecture. The exact role can change
as the production infrastructure evolves.
What is SMTP2GO used for?
SMTP2GO is used where configured to support transactional or operational
email delivery. This can involve recipient email addresses, message
content and delivery-related technical information required to send
the relevant communication.
Why is Cloudflare listed?
Cloudflare services may be used where configured for security,
anti-abuse or human-verification functionality such as Turnstile.
The exact information processed depends on the enabled service and workflow.
Are Booking.com or other distribution platforms HotelConnect24 subprocessors?
Not automatically. A distribution partner may operate under its own
independent role and commercial relationship. Whether an organisation
is a subprocessor depends on the actual processing arrangement, not
simply on the fact that systems exchange booking information.
Are all technology partners subprocessors?
No. An integration alone does not determine the legal role. Technology
partners may act under different processing relationships depending on
the service and data flow.
Can HotelConnect24 add new subprocessors?
Yes. HotelConnect24 may add or replace providers as the platform evolves.
Relevant production changes should be reflected in this register and,
where required, handled according to applicable contractual notice provisions.
Can a subprocessor be located outside the European Economic Area?
Depending on the provider and service, international processing may be
possible. Relevant service regions, contractual safeguards and transfer
requirements should be considered according to the actual processing arrangement.
Where can I read more about HotelConnect24 data protection?
See the HotelConnect24 Data Protection page, Privacy Policy and Data
Processing Agreement for further information about data handling and
business processing relationships.
How can I ask a question about a specific provider?
Use the official HotelConnect24 contact route and identify the provider,
HotelConnect24 service and processing question you would like clarified.
Know the Services Behind the Service.
HotelConnect24 aims to keep relevant third-party processing visible so hotels and partners can better understand the infrastructure and service providers supporting the platform.