Providers
The table is generated from a single canonical register measured against the Bokko code. List version: v1-r4.
Platform and infrastructure
| Provider | Role | Purpose | Data categories and data subjects | Place of processing | Transfer outside the EEA and safeguard | Status |
|---|---|---|---|---|---|---|
| Google Cloud / Firebase — Firestore database, Cloud Functions, Cloud Storage Google Cloud EMEA Limited (Írország); anyavállalat: Google LLC (USA) | Sub-processor | storage of platform data and server-side processing; storage of uploaded images and import/export files | booking data; contact data (name, email, phone); account and authentication data; uploaded images Data subjects: guests, providers (subscribers), staff members | EU — europe-west1 (Belgium): Firestore bokko-eu database, Cloud Functions, Cloud Storage bucket, database backups | access from outside the EEA (USA) possible Standard Contractual Clauses (EU 2021/914); EU–US Data Privacy Framework (DPF) | Active |
| Firebase Hosting Google Cloud EMEA Limited (Írország); anyavállalat: Google LLC (USA) | Sub-processor | serving the static content of the web surfaces (dashboard, booking page, help, documentation) | technical logs (identifiers, IP address) Data subjects: guests, providers (subscribers), staff members, website visitors | global content delivery network (CDN) — not a regional service | processing outside the EEA Standard Contractual Clauses (EU 2021/914); EU–US Data Privacy Framework (DPF) | Active |
| Firebase Authentication Google Cloud EMEA Limited (Írország); anyavállalat: Google LLC (USA) | Sub-processor | sign-in of provider and staff accounts (email/password, Google account) | account and authentication data; technical logs (identifiers, IP address) Data subjects: providers (subscribers), staff members | global service — not regional; the location of account data cannot be pinned to the EU | processing outside the EEA Standard Contractual Clauses (EU 2021/914); EU–US Data Privacy Framework (DPF) | Active |
| Google Cloud Logging Google Cloud EMEA Limited (Írország); anyavállalat: Google LLC (USA) | Sub-processor | storage of server-side operational and audit logs for troubleshooting and security investigation | technical logs (identifiers, IP address) Data subjects: guests, providers (subscribers), staff members | Google global log storage (global location): default logs for 30 days, required audit logs for 400 days | processing outside the EEA Standard Contractual Clauses (EU 2021/914); EU–US Data Privacy Framework (DPF) | Active |
| Google Secret Manager Google Cloud EMEA Limited (Írország); anyavállalat: Google LLC (USA) | Infrastructure (no personal data) | storage of provider API keys and encryption keys | no personal data | automatic (Google-selected multi-region) replication | no transfer outside the EEA | Active |
| Firebase App Check and reCAPTCHA Enterprise Google Cloud EMEA Limited (Írország); anyavállalat: Google LLC (USA) | Sub-processor | filtering automated abuse on the dashboard and the booking page | browser and device signals, IP address Data subjects: guests, providers (subscribers), staff members | Google global infrastructure | processing outside the EEA Standard Contractual Clauses (EU 2021/914); EU–US Data Privacy Framework (DPF) | Active |
| Google Cloud Vision API (SafeSearch image moderation) Google Cloud EMEA Limited (Írország); anyavállalat: Google LLC (USA) | Sub-processor | automated content check of header and gallery images shown on the public booking page; a flagged image is hidden and the provider is notified | uploaded images Data subjects: providers (subscribers), staff members | EU endpoint (eu-vision.googleapis.com); the image is analysed without being stored | access from outside the EEA (USA) possible Standard Contractual Clauses (EU 2021/914); EU–US Data Privacy Framework (DPF) | Active |
| Google Maps Platform — Places (address autocomplete) Google Ireland Limited (Írország); anyavállalat: Google LLC (USA) | Independent controller (recipient) | address autocomplete in dashboard address fields while the user types | address and place search text; browser and device signals, IP address Data subjects: providers (subscribers), staff members | Google global infrastructure | processing outside the EEA Standard Contractual Clauses (EU 2021/914); EU–US Data Privacy Framework (DPF) | Active |
| Google Maps Platform — Geocoding API (server-side) Google Ireland Limited (Írország); anyavállalat: Google LLC (USA) | Independent controller (recipient) | converting the provider's business address into coordinates for map display | address and place search text Data subjects: providers (subscribers) | Google global infrastructure | processing outside the EEA Standard Contractual Clauses (EU 2021/914); EU–US Data Privacy Framework (DPF) | Active |
Communication
| Provider | Role | Purpose | Data categories and data subjects | Place of processing | Transfer outside the EEA and safeguard | Status |
|---|---|---|---|---|---|---|
| Firebase Cloud Messaging (push notifications) Google Cloud EMEA Limited (Írország); anyavállalat: Google LLC (USA) | Sub-processor | delivery of push notifications to dashboard users; the push text contains no guest name | push token (pseudonymous device identifier), notification content Data subjects: providers (subscribers), staff members | Google global infrastructure | processing outside the EEA Standard Contractual Clauses (EU 2021/914); EU–US Data Privacy Framework (DPF) | Active |
| Mailjet (email delivery) Mailjet SAS (Franciaország); a Sinch-csoport tagja | Sub-processor | delivery of transactional and newsletter emails (booking notices, reminders, account and billing mail) | email address, message content, delivery metadata Data subjects: guests, providers (subscribers), staff members | EU (France) | access from outside the EEA (USA) possible Standard Contractual Clauses (EU 2021/914) | Active |
| BulkGate (SMS delivery) Spoje.net, s.r.o. (Csehország) | Sub-processor | optional SMS reminders before confirmed appointments | phone number, message content, delivery metadata Data subjects: guests | EU (Czech Republic) — platform storage; the delivery chain (mobile carriers, SMS aggregators) may involve third countries | access from outside the EEA (USA) possible Standard Contractual Clauses (EU 2021/914) | Active |
Optional integrations
| Provider | Role | Purpose | Data categories and data subjects | Place of processing | Transfer outside the EEA and safeguard | Status |
|---|---|---|---|---|---|---|
| Google Calendar API Google Ireland Limited (Írország); anyavállalat: Google LLC (USA) | Sub-processor | optional calendar sync: writing bookings into the provider's or staff member's Google Calendar and reading the staff member's free/busy status — only after explicit connection | calendar events and free/busy status; booking data Data subjects: guests, providers (subscribers), staff members | Google global infrastructure | processing outside the EEA Standard Contractual Clauses (EU 2021/914); EU–US Data Privacy Framework (DPF) | Active |
| Microsoft Graph (Outlook calendar) Microsoft Ireland Operations Ltd. (Írország); anyavállalat: Microsoft Corporation (USA) | Sub-processor | optional staff calendar sync with a Microsoft 365 / Outlook account — only after the staff member explicitly connects | calendar events and free/busy status; booking data Data subjects: guests, staff members | Microsoft global infrastructure (per the EU Data Boundary) | access from outside the EEA (USA) possible Standard Contractual Clauses (EU 2021/914); EU–US Data Privacy Framework (DPF) | Active |
Payments and invoicing
| Provider | Role | Purpose | Data categories and data subjects | Place of processing | Transfer outside the EEA and safeguard | Status |
|---|---|---|---|---|---|---|
| Stripe (subscription fees and optional guest payments) Stripe Payments Europe, Limited (Írország); anyavállalat: Stripe, Inc. (USA) | Sub-processor; independent controller for its own purposes | collection of Bokko subscription fees; guest payment features enabled by the provider (deposit, card guarantee) via the provider's own Stripe Connect account; for its own purposes (fraud prevention, risk management, anti-money-laundering customer due diligence, legal obligations) Stripe is an independent controller under its own notice | payment and billing metadata; contact data (name, email, phone) Data subjects: providers (subscribers), guests | EU (Ireland) and USA | processing outside the EEA Standard Contractual Clauses (EU 2021/914); EU–US Data Privacy Framework (DPF) | Active |
| Barion (optional guest payments) Barion Payment Zrt. (Magyarország) | Sub-processor; independent controller for its own purposes | guest payment features when the provider connects a Barion account; for its own purposes (fraud prevention, risk management, anti-money-laundering customer due diligence, obligations of a supervised electronic money institution) Barion is an independent controller under its own notice | payment and billing metadata Data subjects: guests | EU (Hungary) | no transfer outside the EEA | Active |
| SimplePay (prepared guest payments) OTP Mobil Kft. (Magyarország) | Sub-processor | prepared guest payment route; closed by a contract gate, no data flow | payment and billing metadata Data subjects: guests | EU (Hungary) | no transfer outside the EEA | Prepared, not active |
| Billingo (invoicing) Billingo Technologies Zrt. (Magyarország) | Sub-processor | issuing Bokko subscription invoices; issuing guest invoices when the provider enables the Billingo integration | billing name, address, email, tax number, line items Data subjects: providers (subscribers), guests | EU (Hungary) | no transfer outside the EEA | Active |
| Számlázz.hu (invoicing) KBOSS.hu Kft. (Magyarország) | Sub-processor | issuing guest invoices when the provider enables the Számlázz.hu integration | billing name, address, email, tax number, line items Data subjects: guests | EU (Hungary) | no transfer outside the EEA | Active |
Websites and error logging
| Provider | Role | Purpose | Data categories and data subjects | Place of processing | Transfer outside the EEA and safeguard | Status |
|---|---|---|---|---|---|---|
| Google Maps embedded map (booking page) Google Ireland Limited (Írország); anyavállalat: Google LLC (USA) | Independent controller (recipient) | map of the provider's location on the booking page; loaded only when the visitor clicks | browser and device signals, IP address Data subjects: guests, website visitors | Google global infrastructure | processing outside the EEA EU–US Data Privacy Framework (DPF) | Active |
| Sentry (client-side error logging on the dashboard) Functional Software, Inc. (Sentry, USA) | Sub-processor | logging errors of the dashboard and admin interface; email addresses, phone numbers and tokens are redacted before sending | error reports (stack trace, client metadata, pseudonymous identifiers) Data subjects: providers (subscribers), staff members | EU data region (Frankfurt, ingest.de.sentry.io); support access from the USA possible | access from outside the EEA (USA) possible Standard Contractual Clauses (EU 2021/914); EU–US Data Privacy Framework (DPF) | Active |
| Cloudflare (DNS and reverse proxy for getbokko.com) Cloudflare, Inc. (USA) | Sub-processor | authoritative DNS for the getbokko.com, bokko.app and bokko.io domains; forwarding traffic of the getbokko.com marketing site (proxy/CDN). Traffic of the applications under bokko.app and bokko.io does not pass through Cloudflare. | visit metadata (IP address, request headers), aggregated statistics Data subjects: website visitors | Cloudflare global network | processing outside the EEA Standard Contractual Clauses (EU 2021/914); EU–US Data Privacy Framework (DPF) | Active |
| Cloudflare Web Analytics (getbokko.com) Cloudflare, Inc. (USA) | Sub-processor | cookie-less, aggregated visit measurement on getbokko.com, only after consent | visit metadata (IP address, request headers), aggregated statistics Data subjects: website visitors | Cloudflare global network | processing outside the EEA Standard Contractual Clauses (EU 2021/914); EU–US Data Privacy Framework (DPF) | Active |
| jsDelivr (script CDN of the developer documentation) Volentio JSD Limited (Egyesült Királyság) | Independent controller (recipient) | loading the API reference viewer script on docs.bokko.io; the visitor's browser contacts the CDN directly | browser and device signals, IP address Data subjects: website visitors | global content delivery network | processing outside the EEA European Commission adequacy decision (United Kingdom) | Active |
A provider marked “independent controller (recipient)” is not Bokko's processor: it processes the data passed to it under its own terms. A provider marked “independent controller for its own purposes” is a sub-processor for the processing carried out on Bokko's behalf, and an independent controller for its own purposes (for example fraud prevention and legal obligations); for these its own notice applies.
Transfer safeguards
Transfers outside the EEA are based on the following mechanisms:
- Standard contractual clauses (SCC): the clauses under European Commission Implementing Decision 2021/914/EU.
- EU–US Data Privacy Framework: where the provider is certified under the framework, the transfer is based on the adequacy decision of July 10, 2023.
- Adequacy decision (United Kingdom): transfers to the United Kingdom are based on the European Commission's adequacy decision under Article 45 GDPR, renewed in December 2025.
For questions or to check the current safeguards, write to support@bokko.app.