Subprocessors
Last updated: August 2026 · v1.0
To operate the Bookify Malta platform and public website we rely on a small number of subprocessors. Each one processes personal data only to deliver the specific function described below, under written agreements that include GDPR Article 28 obligations. Bookify configures the listed hosting and processing services to use European Union regions where described in this register, and we publish each provider’s privacy policy and transfer mechanism so you can verify how your data is handled.
Google Cloud / Firebase
Authentication (Firebase Auth), data storage (Cloud Firestore), backend logic (Cloud Functions), and scheduling of SMS reminder tasks (Cloud Tasks). Hosts the platform and all data in a European region.
Data region: EU (Google Cloud region in Europe)
Transfer mechanism: Data stored in the EU; no transfer outside the EU for the processing described here.
Render (Render.com Inc.)
Hosts the public Bookify Malta marketing website (bookify.mt), including the contact and onboarding forms whose submissions are delivered to info@bookify.mt. Render is the infrastructure provider for the marketing website only; the platform application itself runs on Google Cloud / Firebase.
Data processed: Contact and onboarding form submissions (business name, contact name, email address, phone number, location, business type, plan preference and notes) and transient server logs.
Data region: Processing region: Frankfurt, Germany (EU)
Legal entity: Render.com Inc. is a United States legal entity.
Transfer mechanism: Render’s GDPR Data Processing Agreement (render.com/dpa) is available to all Render customers and governs personal data processed through Render services. Render is certified under the EU-U.S. Data Privacy Framework (with UK Extension and Swiss-U.S. DPF). The marketing website is configured to Render’s Frankfurt (EU) region.
Epic Communications Ltd (Epic Malta)
Delivers automated SMS reminders to your clients’ phone numbers, 24 hours before each appointment, on your behalf. Epic is a Maltese mobile network operator, regulated by the Malta Communications Authority and based in the EU. SMS messages route through Bookify-controlled messaging infrastructure hosted on DigitalOcean in Germany before reaching Epic for final delivery. Epic acts as a processor for delivery only: it does not retain message content and keeps only the limited delivery and billing metadata required by Maltese telecommunications law.
Data region: Malta, EU (relay via DigitalOcean, Frankfurt, Germany)
Transfer mechanism: SMS delivery takes place in Malta. The relay is configured to DigitalOcean’s Frankfurt region; DigitalOcean is a United States legal entity whose processing is safeguarded under its DPA (entered automatically with its Terms of Service) and EU Standard Contractual Clauses (2021/914), with EU-U.S. DPF certification for transfers (see the DigitalOcean entry below).
DigitalOcean, LLC
Hosts Bookify’s SMS messaging relay: a cloud server (droplet) in Frankfurt, Germany that formats and forwards reminder messages to Epic Malta for delivery. DigitalOcean is the infrastructure provider only and does not access message content beyond the technical handling required to run the server.
Data processed: Destination telephone number, reminder message, transmission metadata and delivery-routing information.
Data region: Processing region: Frankfurt, Germany
Legal entity: DigitalOcean, LLC is a United States legal entity.
Transfer mechanism: DigitalOcean’s Data Processing Agreement (digitalocean.com/legal/data-processing-agreement) is entered automatically when its Terms of Service are accepted and incorporates EU Standard Contractual Clauses (Commission Decision (EU) 2021/914). DigitalOcean is certified under the EU-U.S. Data Privacy Framework (with UK Extension and Swiss-U.S. DPF) for transfers from the EEA; if that framework is invalidated, transfers fall back to the EU SCCs. The server is configured to the EU region (Frankfurt), but data does not remain in the EU solely because of that server location — DigitalOcean’s US legal entity and any support access are covered by the DPA, DPF certification and SCCs.
SiteGround Hosting Ltd (SiteGround EU)
Sends transactional email, including account notifications, invoices, support messages and signup notifications, through its SMTP service. SiteGround is registered in the EU.
Data region: EU
Transfer mechanism: Processing in the EU; any transfer relies on EU Standard Contractual Clauses.
Where a subprocessor stores data outside the EU/EEA, transfers rely on appropriate safeguards such as EU Standard Contractual Clauses (Commission Decision (EU) 2021/914), an applicable adequacy decision, or other safeguards permitted under Chapter V GDPR. In practice, the hosting and processing services listed above are configured to use European Union regions, as described in this register.
Updates to this list
We will update this page whenever a subprocessor is added, removed or changes role, and we notify customers by email at least 30 days before a new subprocessor starts processing data. Customers may object on reasonable data-protection grounds within that window, as described in our Data Processing Agreement.
Contact
Questions about our subprocessors? Email legal@bookify.mt.