A sub-processor is a third party PRIMA engages to process personal data on behalf of a customer. This page lists every sub-processor currently engaged, together with the purpose, the contracting entity and its location, and the mechanism relied upon for any transfer outside the European Economic Area.
It forms Annex III of the PRIMA Data Processing Addendum. PRIMA gives customers at least 30 days' notice before a new sub-processor begins processing their data, by email to the data protection contact on file and by updating this page. Customers may object on reasonable data protection grounds within that period, as set out in Section 7 of the Addendum.
| Sub-processor | Purpose | Entity & location | Transfer mechanism |
|---|---|---|---|
| DigitalOcean, LLC | Application hosting, managed PostgreSQL, managed Valkey, object storage | United States — New York | SCCs |
| Supabase, Inc. | Secondary PostgreSQL database and authentication | United States — Northern Virginia | SCCs |
| Amazon Web Services, Inc. | Cloud platform and model inference via Amazon Bedrock | United States; Europe (Paris) from 31 October 2026 | SCCs |
| Vercel Inc. | Front-end hosting and edge delivery | United States and global edge | SCCs |
| Cloudflare, Inc. | DNS, Web Application Firewall, content delivery | Global edge | SCCs |
| Stripe, Inc. / Stripe Payments Europe Ltd | Payment processing and payouts | United States and Ireland | SCCs; Ireland adequate |
| Twilio Inc. | Transactional SMS | United States | SCCs |
| SimpleTexting, LLC | Transactional SMS, regional routing | United States | SCCs |
| ClickSend Pty Ltd (Sinch group) | Transactional SMS, regional routing | Melbourne, Australia | SCCs |
| Mailgun Technologies, Inc. (Sinch group) | Transactional email | San Antonio, Texas, United States | SCCs |
| Functional Software, Inc. (Sentry) | Error and exception monitoring | United States | SCCs |
Where PRIMA accesses a reservation or guest management system operated by a customer, that system's provider is the customer's own processor, not a sub-processor of PRIMA. PRIMA accesses the customer's tenancy under credentials the customer provides and may revoke at any time.
Where PRIMA uses large language models, inference is executed through Amazon Bedrock inside PRIMA's own AWS account, under IAM-scoped and audit-logged access. Prompt and completion content is not retained by, nor used to train the models of, the model provider. Amazon Web Services is the sub-processor for this activity; the model provider is not, and no customer personal data is transmitted to any model provider's own API.
PRIMA's production platform currently operates in the United States. From 31 October 2026, all personal data relating to data subjects in the European Economic Area will be stored and processed at rest in the Amazon Web Services Europe (Paris) region. This page will be updated on completion of that migration.
Customers are notified by email to the data protection contact on file. To add or change that contact, or to receive notifications at an additional address, write to prima@primavip.co.
© 2026 PRIMA · Members-only access