Skip to content
Live demo

Sub-processors

Last updated November 11, 2026

Tekravel is operated by TEKRAVEL TRAVEL AND TECHNOLOGIES - FZCO. We use the service providers below to run the platform. When we process personal data for a travel business that uses Tekravel, they are our sub-processors under our Data Processing Addendum; for the personal data we handle for our own purposes, they are the service providers our Privacy Policy describes. Each one receives only the data it needs for its task. For each provider, the list says what it does for us, the personal data it receives, where it is based and, where the data leaves the country it was collected in, how that transfer is protected. For the personal data we process for travel businesses, the "International transfers" section of our Data Processing Addendum sets the rules we follow; for the personal data we handle for our own purposes, the "International transfers" section of our Privacy Policy explains them.

Hosting, delivery and security

  • Microsoft Azure

    What it does for us
    Hosting of the platform, the booking websites, the partner panel and this website: servers, databases, file storage, cache and monitoring. Where it is switched on, it also reads the passport scanned in a booking.
    Personal data it receives
    All the data kept on the platform, such as accounts, bookings, travellers' details, payment records, messages and files, and request logs with IP addresses.
    Where it is based
    Microsoft Corporation, United States. The platform is hosted in Microsoft's European data centres, in the Netherlands (West Europe) and Ireland (North Europe).
    Transfer safeguard
    Hosted in the European Union, under Microsoft's Data Protection Addendum with the EU standard contractual clauses.

  • Cloudflare

    What it does for us
    Delivery of this website and the booking websites, protection against attacks, domain name records and the Turnstile bot check on forms. On booking websites that switch it on, and only with the visitor's consent, it also counts page views without cookies.
    Personal data it receives
    IP addresses, request details and the browser signals used for the bot check; for page statistics, the page address, referrer and load times.
    Where it is based
    Cloudflare, Inc., United States. Requests are handled in the Cloudflare data centre closest to the visitor.
    Transfer safeguard
    Cloudflare's data processing addendum, with the EU standard contractual clauses.

Payments

  • Stripe

    What it does for us
    Card payments made to us: the platform's own invoices, add-ons and content-credit top-ups, and bookings and wallet top-ups on the platform's own booking website. We do not take payments from a travel business's customers.
    Personal data it receives
    Name, email address, amount and the booking, invoice or top-up reference. Card details are typed into Stripe's own form and never reach us.
    Where it is based
    Stripe, Inc., United States, and its affiliates in other countries.
    Transfer safeguard
    Stripe's data processing agreement, with the EU standard contractual clauses.

Verification and contracts

  • Didit

    What it does for us
    Identity and company verification (KYC and KYB) when a travel business asks for Travel Content from us (before it signs the Content Agreement), production API access, sharing its inventory with the Network, or trading as a B2B agency on our storefront.
    Personal data it receives
    Identity documents, a selfie and liveness check, and the company documents of the people who own or manage the business.
    Where it is based
    Spain (European Union).
    Transfer safeguard
    Based in the European Union, where the GDPR applies.

  • Zoho (Zoho Sign and Zoho Mail)

    What it does for us
    Electronic signature of the platform contract (Zoho Sign), and our own mailboxes (Zoho Mail), including our support mailbox and the careers mailbox that receives job applications.
    Personal data it receives
    The signer's name and email address, and the signed contract; the emails sent to and from our mailboxes, with their attachments, such as CVs.
    Where it is based
    Zoho Corporation, in Zoho's data centre in the United States.
    Transfer safeguard
    Zoho's data processing addendum, with the EU standard contractual clauses.

Email, text messages and messaging apps

  • Amazon Web Services (Amazon SES and SNS)

    What it does for us
    Sending emails, and reporting bounces and complaints so that we stop writing to addresses that do not work or do not want our emails.
    Personal data it receives
    The recipient's email address and the content of the email.
    Where it is based
    Amazon Web Services, Inc., United States, from the AWS region we have chosen for email.
    Transfer safeguard
    The AWS data processing addendum, with the EU standard contractual clauses.

  • Meta (WhatsApp Business Platform and Facebook)

    What it does for us
    Sending WhatsApp notifications and chat messages, receiving the WhatsApp messages people send to the numbers a business connects, and the Facebook sign-in that opens in the Admin Panel to connect a WhatsApp Business account.
    Personal data it receives
    Phone number and the content of the messages, and the Facebook sign-in of the staff member who connects the account.
    Where it is based
    WhatsApp LLC (Meta), United States.
    Transfer safeguard
    The WhatsApp Business data processing terms, with the EU standard contractual clauses.

  • Telegram

    What it does for us
    Sending Telegram notifications and chat messages through a Telegram bot.
    Personal data it receives
    The Telegram chat ID and the content of the messages.
    Where it is based
    United Arab Emirates (Dubai).
    Transfer safeguard
    Based in the United Arab Emirates; Telegram's own terms and privacy policy also apply to the messages.

  • Twilio

    What it does for us
    Sending text messages (SMS) to most countries; never to Iranian numbers.
    Personal data it receives
    Phone number and the content of the message.
    Where it is based
    Twilio Inc., United States.
    Transfer safeguard
    Twilio's data protection addendum, with the EU standard contractual clauses.

  • Vonage

    What it does for us
    Sending text messages (SMS) to most countries; never to Iranian numbers.
    Personal data it receives
    Phone number and the content of the message.
    Where it is based
    United States.
    Transfer safeguard
    Vonage's data processing addendum, with the EU standard contractual clauses.

  • Infobip

    What it does for us
    Sending text messages (SMS) to most countries; never to Iranian numbers.
    Personal data it receives
    Phone number and the content of the message.
    Where it is based
    Croatia (European Union), with its contracting company in the United Kingdom.
    Transfer safeguard
    Based in the European Union and the United Kingdom, which an EU adequacy decision covers.

  • D7 Networks

    What it does for us
    Sending text messages (SMS) to most countries; never to Iranian numbers.
    Personal data it receives
    Phone number and the content of the message.
    Where it is based
    United Arab Emirates (Dubai).
    Transfer safeguard
    Based in the United Arab Emirates.

  • Unifonic

    What it does for us
    Sending text messages to phone numbers in the Gulf states (the UAE, Saudi Arabia, Kuwait, Bahrain, Oman and Qatar) only.
    Personal data it receives
    Phone number and the content of the message.
    Where it is based
    Saudi Arabia (Riyadh).
    Transfer safeguard
    Used only to deliver messages to numbers in the Gulf states, as the recipient expects.

Website features and content

  • ipwho.is

    What it does for us
    Estimating the country of an IP address, to pre-fill country fields in our forms and to protect sign-ins.
    Personal data it receives
    The IP address only.
    Where it is based
    The provider's own servers.
    Transfer safeguard
    Receives only an IP address, for a one-off lookup.

  • Google

    What it does for us
    The map of our office on this website, which loads only after you choose to show it, and the "Sign in with Google" prompt on booking websites, which loads only after the visitor accepts functional cookies.
    Personal data it receives
    IP address and browser details, when the map or the prompt loads.
    Where it is based
    Google LLC, United States; Google Ireland Limited for people in the European Union.
    Transfer safeguard
    Google's terms, with the EU standard contractual clauses.

  • OpenStreetMap

    What it does for us
    Map tiles for the hotel results map on booking websites.
    Personal data it receives
    IP address, browser details and the map area viewed.
    Where it is based
    OpenStreetMap Foundation, United Kingdom; tiles are delivered through a content delivery network.
    Transfer safeguard
    Based in the United Kingdom, which an EU adequacy decision covers.

  • Unsplash

    What it does for us
    Photos in the live demo on our homepage, default destination photos in some website templates, and sample photos in the theme studio of the Admin Panel.
    Personal data it receives
    IP address and browser details, when a photo loads.
    Where it is based
    Canada.
    Transfer safeguard
    Based in Canada, which an EU adequacy decision covers.

  • jsDelivr

    What it does for us
    The text-recognition files a booking website uses to read a passport scan on the visitor's own device; the image stays on the device.
    Personal data it receives
    IP address and browser details, when the files load; nothing about the passport.
    Where it is based
    A public content delivery network for open-source files, with servers around the world.
    Transfer safeguard
    Receives only the request for the files, never the passport image or its details.

  • Anthropic

    What it does for us
    Drafting articles for our own blog, and for the websites of partners who use the AI SEO add-on.
    Personal data it receives
    No traveller or customer data: the site name, niche, language, topic, keywords and tone of an article, and the titles of up to 40 of the site's recent posts, including drafts, so that a new article does not repeat them.
    Where it is based
    Anthropic, PBC, United States.
    Transfer safeguard
    No traveller or customer data is sent.

Our regional representatives (Masters)

  • Masters

    What it does for us
    Supporting the travel businesses assigned to them: a Master, and any top-level master above it, can access a business's partner panel to support it, handle cases and supervise its part of the network.
    Personal data it receives
    The personal data in that business's partner panel that the task needs, such as bookings, travellers' details, customer accounts and messages.
    Where it is based
    The Master assigned to the business, whose name and contact details its partner panel shows; we tell the business on request where it is based.
    Transfer safeguard
    A written contract with us with the same data protection obligations as our other sub-processors and, where the data leaves the country it was collected in, the safeguards in the international transfers section of our Data Processing Addendum (the EU standard contractual clauses, with the UK addendum, where the EU or UK GDPR applies).

Accounts a partner connects itself

A travel business can connect its own accounts instead of ours, such as its own SMS provider, email (SMTP) account or WhatsApp Business number. Its booking website also takes card payments only through a payment gateway that the business connects under its own contract with the payment company. Each such provider works under the business's own contract with it and is not our sub-processor for the data it handles there.

Companies that act on their own account

When a booking is made, the airlines, reservation systems, consolidators and hotel, package and attraction suppliers concerned receive the traveller details they need to issue and service it. They handle those details under their own terms and privacy policies and are not our sub-processors. The same applies to Google, Apple, Facebook and Microsoft when a visitor chooses to sign in with them.

Changes to this list

Before a new sub-processor starts processing personal data for a travel business, we update this list and tell the business by email or in the partner panel at least 30 days in advance, so that it can object, unless we must act sooner for security reasons or to keep the service running, in which case we tell it as soon as we can, as our Data Processing Addendum describes. Questions about this list: [email protected].