Legal
Sub-processors
Who runs infrastructure behind RezRoute, what each provider does for us, and where each is established.
Last updated 24 October 2026 · Draft, pending legal review
This page supports the data processing terms, which give general written authorisation under Article 28(2) for RezRoute to engage sub-processors on the conditions set out there. Each provider named here is engaged under a contract imposing data protection obligations no less protective than those terms, and RezRoute remains fully liable to the controller for what its sub-processors do.
RezRoute has two data protection roles. Providers behind this website are engaged by us as a controller of website server logs. Providers behind the router are engaged as sub-processors under the Article 28 terms, handling traveller data on the instructions of the marketplace that holds the product. Clause 1 of the data processing terms explains why that distinction is the one to get right.
Two design decisions keep this list short. The service holds no copy of availability and creates no separate booking store, so there is no analytics warehouse, no customer database and no reporting stack in the chain. And no payment data enters the service at all, so no payment provider appears below.
Providers, as at 24 October 2026
RezRoute is the controller of the server logs of the marketing website, so the provider below is our processor rather than a sub-processor engaged under the Article 28 terms. It is listed because a reader asking who runs this site deserves the answer in the same place as the rest.
| Provider | What it does for us | Country |
|---|---|---|
| Vercel | Hosting and delivery of the rezroute.com website. Personal data reaching it is limited to the server logs of a page request, including the visitor IP address. The site sets no cookies, runs no analytics and carries no tracking of any kind, so nothing beyond the request itself is collected. No operator data and no traveller data reaches this website. | The provider entity is established in the United States. |
No provider handling money appears in the table. Connectivity is free on both The Greek Local and Cyprus Bucket List, nothing is deducted from a booking, and no money passes through the service. If a charge is ever introduced, the accounting and invoicing provider that comes with it will be added here, with notice, before it processes anything.
Not sub-processors
Parties in the flow that this register does not cover
The two marketplaces
The Greek Local and Cyprus Bucket List are not sub-processors of RezRoute. For traveller booking data each is the controller: the party whose instructions the router acts on, and the system that owns the booking record. A call reaching a marketplace is the destination of an instruction, not an onward disclosure by us.
This is worth being exact about, because the service and the two marketplaces are closely related and the easy thing would be to blur it. The relationship is set out in clause 1 of the data processing terms. The providers each marketplace uses behind its own platform are the controller's processors, published in that marketplace's own privacy notice, and they are not listed here because they are not ours to authorise.
The sales channels
GetYourGuide and Viator are separate controllers, not sub-processors. Each takes the sale, decides its own purposes, holds traveller data under its own privacy notice, and sends a booking payload to us. Data reaches a channel because the traveller bought from it, not because we passed the data on.
The operator
The operator receives the booking in the marketplace portal it already uses, and decides for itself how it runs the tour. Calendars are managed there, not here. RezRoute has no operator dashboard and no account to sign up for.
Changes
How a change is notified, and how you object
Before a new or replacement sub-processor begins processing personal data, we do all of the following.
- Update this page, and change the date at the top of it. The date is the record: if the date has not moved, the register has not changed.
- Email the named contact for every connected operator, and the marketplace acting as controller, describing the provider, what it is for, what data will reach it, and the country it will be in.
- Allow an objection period before the change takes effect.
To object, write to connectivity@rezroute.com within the objection period and say which provider you object to and why. An objection is answered by a person, not by an acknowledgement. Where the objection cannot be resolved, the question is whether the connection can continue without that provider.
Where a change to a sub-processor would also affect how a connection works, the notice period in the terms of service applies as well, because a connectivity change reaches an operator's live selling rather than only their paperwork.