What this page is
Estadia is a data processor for the personal data its operator customers (hotels, holiday rentals, vehicle-rental businesses) collect from their guests under Royal Decree 933/2021. To deliver the service we rely on a small number of carefully selected third parties ("sub-processors") that process personal data on our behalf. This page lists every one of them, what they do and where they process the data.
This list is incorporated by reference into the Data Processing Agreement signed with each operator customer. Operator customers should treat it as the canonical Annex C of that DPA.
Current sub-processors
Supabase Inc.: database, authentication, storage and edge functions. Hosted in the European Union (Ireland, eu-west-1). Covered by the Supabase standard Data Processing Agreement (https://supabase.com/legal/dpa).
Microsoft Ireland Operations Ltd. (Azure OpenAI): optical-character recognition of identity-document images uploaded by guests during check-in. Hosted in West Europe. Covered by Microsoft's standard Data Processing Addendum (https://aka.ms/DPA). Microsoft retains inputs for up to 30 days for abuse-monitoring purposes; the opt-out from this is only available to Microsoft managed customers (those with a dedicated account team), and Estadia does not currently qualify. After the 30-day window the data is deleted by Microsoft.
Brevo SAS: transactional email delivery (check-in notifications and other operational communications) on behalf of operators, and delivery of internal lead notifications to the Estadia team via the marketing-site contact form. Hosted in the European Union. Covered by Brevo's standard Data Processing Agreement (https://www.brevo.com/legal/dpacca/).
Cloudflare Inc.: hosting and content-delivery network for the marketing site, the operator dashboard and the guest check-in page. Cached and processed at Cloudflare's European edge locations. Covered by Cloudflare's standard Data Processing Addendum and Standard Contractual Clauses (https://www.cloudflare.com/cloudflare-customer-dpa/).
Functional Software Inc. (Sentry, sentry.de): error monitoring and crash diagnostics. Hosted in Germany. Covered by Sentry's standard Data Processing Agreement (https://sentry.io/legal/dpa/). Personally identifying fields are scrubbed at the SDK layer before transmission; only presence flags and stack traces are sent.
International transfers
All sub-processors listed above process the data within the European Economic Area or under appropriate safeguards under Chapter V of the GDPR. Where a parent group is established outside the EEA (Microsoft, Cloudflare, Functional Software, Supabase), incidental access by US affiliates is governed by the Standard Contractual Clauses included in each sub-processor's contract, together with the technical and organisational measures described in Annex B of the Estadia DPA.
How we choose and review sub-processors
Before engaging a sub-processor we verify that they offer a written DPA conforming to Article 28 of the GDPR, that data is processed in the EEA or under SCCs, that the security posture is commensurate with the data category, and that there is a workable mechanism for breach notification. We review this list at least once a year and any time we add or replace a sub-processor.
Notice of changes
We will notify operator customers of any intended addition or replacement of a sub-processor at least thirty (30) days in advance, by email to the data-protection contact registered in the operator's account and by updating this page.
If, within that thirty-day window, an operator objects to the new sub-processor on reasonable, documented grounds, we will work in good faith to find a workable alternative. If no reasonable alternative is available, the operator may terminate the affected part of the contract without penalty.
To subscribe to changes to this list, email [email protected] with the subject "Subprocessors". You will be added to a notification list and will receive an email each time this page changes.
Contact
Any question about this list, or any objection to a current or proposed sub-processor, should be sent to [email protected]. We acknowledge requests within five working days.