Home/Sub-processors

Sub-processors

Third-party service providers that help us deliver Pepperoni Booking. All sub-processors are carefully vetted for GDPR compliance.

Home/Sub-processors

About This List

As a data processor under GDPR, we maintain transparency about the third-party service providers (sub-processors) we use to deliver our services. Each sub-processor is bound by data protection agreements and appropriate safeguards for international transfers.

Last updated: January 12, 2026

Google Cloud Platform

GDPR DPA

Belgium (EU)Cloud infrastructure, database hosting, storage

Primary hosting provider for our application, database (Cloud SQL), and file storage. Data stored in EU region (europe-west1).

Stripe

SCCs

USAPayment processing

Handles all payment transactions. Stripe is PCI-DSS Level 1 certified and maintains Standard Contractual Clauses for EU data transfers.

PayPal

SCCs

USAPayment processing

Alternative payment option for subscription billing. PayPal maintains Standard Contractual Clauses for EU data transfers.

Sentry

SCCs

USAError monitoring

Monitors application errors to ensure service reliability. Error data may include request context but not sensitive personal data.

Google Workspace

SCCs

USAEmail delivery

Sends transactional emails (booking confirmations, reminders). Google Workspace maintains Standard Contractual Clauses.

Upstash

DPA

Tokyo, JapanRedis (task queue)

Provides Redis infrastructure for background task processing. Stores only temporary task metadata, not personal data.

Vercel

SCCs

USAFrontend hosting

Hosts our web application frontend. Vercel maintains Standard Contractual Clauses for EU data transfers.

International Transfer Safeguards

Standard Contractual Clauses (SCCs)

For transfers to the USA, we use the European Commission's 2021 Standard Contractual Clauses, which provide appropriate safeguards for personal data transferred outside the EU/EEA.

Data Processing Agreements (DPA)

All sub-processors have signed Data Processing Agreements that meet GDPR Article 28 requirements, including obligations around security, confidentiality, and data subject rights assistance.

Notification of Changes

We will notify you of any changes to our sub-processors at least 14 days before they take effect. As a data controller using our services, you have the right to object to new sub-processors.

To receive email notifications about sub-processor changes, contact us at privacy@pepperonibooking.com

Questions about our sub-processors or data processing?