About this list
Tours is operated by Code Rev S.R.L. (Romania). When our customers use Tours, we process personal data on their behalf as a processor under Art. 28 GDPR. To provide the service, we use the sub-processors listed below.
This list forms part of our Data Processing Agreement (Annex 3). Each sub-processor is bound by a written agreement that provides at least the same level of data protection as our Data Processing Agreement.
Current sub-processors
Application servers and the customer database are hosted in Frankfurt, Germany. All data is encrypted in transit and at rest.
| Sub-processor | Purpose | Data location | Transfer safeguard |
|---|---|---|---|
| Amazon Web Services EMEA SARL, Luxembourg | Application hosting (EC2), transactional email (SES), encrypted backup storage (S3) | Frankfurt, Germany | Processing within the EU; AWS Data Processing Addendum |
| MongoDB Limited, Ireland | Database (MongoDB Atlas) | Frankfurt, Germany | Processing within the EU; MongoDB Data Processing Agreement |
| Cloudflare, Inc., USA | Media storage (R2), content delivery and network security (DDoS protection, TLS) | EU (media storage restricted to EU jurisdiction) | EU-U.S. Data Privacy Framework (Cloudflare, Inc. is certified); EU Standard Contractual Clauses in the Cloudflare Data Processing Addendum as fallback |
| PostHog, Inc., USA | Product analytics for users of the Tours application | EU (Frankfurt, Germany) | PostHog Data Processing Agreement; EU Standard Contractual Clauses; EU-US Data Privacy Framework |
| Twilio Inc., USA | Sending SMS verification codes for bookings | United States (phone number and verification message only) | EU-U.S. Data Privacy Framework (Twilio Inc. is certified); additionally the Twilio Data Protection Addendum with EU Standard Contractual Clauses and Binding Corporate Rules approved by EU data protection authorities |
Not sub-processors
The following providers are used by Tours but do not process personal data on behalf of our customers:
- Stripe processes payments for Tours subscriptions. For this, Tours and Stripe act as independent controllers.
- Microsoft Clarity is used only on the Tours marketing website (getours.app) and only with your consent. It is not used in the Tours application or in published tours.
Changes to this list
We inform our customers at least 14 days before adding or replacing a sub-processor, by email or by updating this page together with a notice. Customers may object on reasonable data protection grounds within that period, as described in our Data Processing Agreement.
If you would like to receive notifications about changes to this list by email, please contact us at the address below.
Contact
For questions about our sub-processors or data protection, contact us at contact@getours.app. For technical problems with the Tours platform, write to support@getours.app.