Legal
Sub-processors
Last updated: 18 October 2026
[ 01 ]
What this list is
These are the companies that process personal data on behalf of NORBA TRAVEL OÜ. For the data a business sends us through the API, they are our sub-processors under the Data Processing Agreement; for the data of our own account holders and of travellers who book on booking.norba.io or in the Norba Travel apps, they are our processors under the Privacy Policy. Each is bound by contract to process the data only on our instructions and to protect it.
We tell API customers by email at least 30 days before we add or replace a sub-processor, and they may object as the Data Processing Agreement (clause 5) describes. This page always shows the list in force.
[ 02 ]
Sub-processors
| Provider | What it does | Where the data is | Safeguard for a transfer |
|---|---|---|---|
| Render Services, Inc. — 525 Brannan Street, Suite 300, San Francisco, CA 94107, United States | Hosting of the API, the websites, the database and the cache | Frankfurt, Germany (EU) | Data stays in the EU. Any access from the United States: EU–US Data Privacy Framework (Render is certified), with the Standard Contractual Clauses in Render's data processing addendum as the fallback |
| Cloudflare, Inc. — 101 Townsend Street, San Francisco, CA 94107, United States | Network security and delivery in front of the API and the booking site; sees that traffic in transit | Cloudflare's global network, inside and outside the EEA | EU–US Data Privacy Framework (Cloudflare is certified), with the Standard Contractual Clauses in Cloudflare's data processing addendum as the fallback |
| Plus Five Five, Inc., which operates Resend — 2261 Market Street #5039, San Francisco, CA 94114, United States | Delivery of the platform's emails — verification, security alerts, booking confirmations, schedule-change notices, billing and team emails | United States | EU–US Data Privacy Framework (certified as Plus Five Five, Inc.), with the Standard Contractual Clauses in Resend's data processing addendum as the fallback |
| Better Stack, Inc. — United States | Server logs and uptime monitoring | European Union and United States | Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) in Better Stack's data processing agreement |
| Linear Orbit, Inc. — 2261 Market Street, Suite 10632, San Francisco, CA 94114, United States | The tool our team answers support tickets in — only for what you send to support | United States | Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) in Linear's data processing addendum; Linear is not certified under the EU–US Data Privacy Framework |
- Render Services, Inc. — 525 Brannan Street, Suite 300, San Francisco, CA 94107, United States
- What it does Hosting of the API, the websites, the database and the cache
- Where the data is Frankfurt, Germany (EU)
- Safeguard for a transfer Data stays in the EU. Any access from the United States: EU–US Data Privacy Framework (Render is certified), with the Standard Contractual Clauses in Render's data processing addendum as the fallback
- Cloudflare, Inc. — 101 Townsend Street, San Francisco, CA 94107, United States
- What it does Network security and delivery in front of the API and the booking site; sees that traffic in transit
- Where the data is Cloudflare's global network, inside and outside the EEA
- Safeguard for a transfer EU–US Data Privacy Framework (Cloudflare is certified), with the Standard Contractual Clauses in Cloudflare's data processing addendum as the fallback
- Plus Five Five, Inc., which operates Resend — 2261 Market Street #5039, San Francisco, CA 94114, United States
- What it does Delivery of the platform's emails — verification, security alerts, booking confirmations, schedule-change notices, billing and team emails
- Where the data is United States
- Safeguard for a transfer EU–US Data Privacy Framework (certified as Plus Five Five, Inc.), with the Standard Contractual Clauses in Resend's data processing addendum as the fallback
- Better Stack, Inc. — United States
- What it does Server logs and uptime monitoring
- Where the data is European Union and United States
- Safeguard for a transfer Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) in Better Stack's data processing agreement
- Linear Orbit, Inc. — 2261 Market Street, Suite 10632, San Francisco, CA 94114, United States
- What it does The tool our team answers support tickets in — only for what you send to support
- Where the data is United States
- Safeguard for a transfer Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) in Linear's data processing addendum; Linear is not certified under the EU–US Data Privacy Framework
[ 03 ]
Airline distribution platforms
When you book a flight, the passenger details go to the airline, which issues the ticket as an independent controller. Some airlines expose their NDC (New Distribution Capability) interface through a platform run by a technology provider, which therefore sees the booking on its way to the airline:
| Platform | Airlines reached through it | Role | Safeguard for a transfer |
|---|---|---|---|
| Accelya group — Farelogix platform | American Airlines, Aegean Airlines, Olympic Air | Runs the airline's NDC interface, on the airline's behalf | Where the platform or the airline is outside the EEA, the transfer is necessary to book the flight the traveller asked for (Art. 49(1)(b) and (c) GDPR) |
- Accelya group — Farelogix platform
- Airlines reached through it American Airlines, Aegean Airlines, Olympic Air
- Role Runs the airline's NDC interface, on the airline's behalf
- Safeguard for a transfer Where the platform or the airline is outside the EEA, the transfer is necessary to book the flight the traveller asked for (Art. 49(1)(b) and (c) GDPR)
Air France and KLM are reached directly, on the airlines' own interface, with no platform in between.
[ 04 ]
Who is not on this list, and why
These receive personal data as independent controllers, under their own privacy notices, not on our instructions:
- The airlines you book with — American Airlines, Air France, KLM, Aegean Airlines and Olympic Air.
- Stripe Payments Europe, Limited (1 Grand Canal Street Lower, Grand Canal Dock, Dublin D02 H210, Ireland) — for the card a business pays our invoices with. Its onward transfers to Stripe, LLC in the United States rest on the EU–US Data Privacy Framework, under which Stripe, LLC is certified.
- Google LLC (United States), which runs "Sign in with Google", and Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), responsible for the Google accounts of people in the EEA — only if you choose "Sign in with Google". Google LLC is certified under the EU–US Data Privacy Framework.
- Apple, through Apple Distribution International Ltd. (Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) for the App Store in the EEA, and Google, through Google Play — when you download the Norba Travel apps from their stores.
For a copy of a transfer safeguard, or a question about any provider, write to hello@norba.io.