Overview
In delivering the GuideUp platform, GuideUp Technologies Private Limited engages the following third-party sub-processors to process personal data on behalf of our Customers. Each sub-processor is bound by a data processing agreement that imposes data protection obligations equivalent to those in our Data Processing Agreement.
We keep this list current and will notify Customers of any changes (additions or replacements) at least 14 days in advance in accordance with our DPA. Customers who have objections to a new sub-processor may raise them as described in the DPA.
For questions about this list or our sub-processor management practices, contact legal@guideup.co.
Current Sub-processors
| Sub-processor | Service / Role | Data Location | Website |
|---|---|---|---|
| MongoDB Atlas MongoDB, Inc. | Cloud-hosted database service. All Customer and passenger data is stored in MongoDB Atlas. | EU and US regions (primary: EU) | mongodb.com |
| DigitalOcean DigitalOcean, LLC | Cloud infrastructure and application hosting. The GuideUp platform runs on DigitalOcean servers. | Amsterdam, Netherlands (EU) | digitalocean.com |
| Stripe Stripe, Inc. | Payment processing. Handles Customer subscription billing and payment card data. GuideUp does not store payment card details. | US / EU (Stripe Ireland Ltd. for EU Customers) | stripe.com |
| Google OAuth Google LLC | Authentication service. Provides single sign-on (SSO) via Google accounts for platform login. | Global (Google infrastructure) | google.com |
| Resend Resend, Inc. | Transactional email delivery. Used to send booking confirmations, account alerts, and platform notifications. | US | resend.com |
| Bokun Bokun ehf. | Booking platform integration. Enables data synchronisation between GuideUp and the Bokun tour booking marketplace. | Iceland / EU | bokun.io |
Data Transfer Safeguards
Where personal data from EEA residents is transferred to sub-processors located outside the EEA (such as Resend in the US and Google's global infrastructure), GuideUp ensures that appropriate transfer mechanisms are in place. These mechanisms include:
- Standard Contractual Clauses (SCCs) as approved by the European Commission
- EU adequacy decisions where applicable (e.g., for transfers to countries recognised as providing adequate protection)
- Sub-processor participation in frameworks such as the EU-US Data Privacy Framework, where applicable
For sub-processors established within the EU (DigitalOcean Amsterdam, Bokun), data remains within the European Economic Area and no cross-border transfer mechanism is required.
Change Notification
GuideUp will notify Customers via email and/or a platform notice at least 14 days before adding or replacing any sub-processor. Customers who object to a change may raise their concerns as set out in the Data Processing Agreement.
This page reflects the sub-processors active as of the "Last Updated" date shown above. Historical versions are available upon request at legal@guideup.co.