Sub-processor list
Controller: the hotelier (the hotel business that uses HERMES PMS).
Processor: Bizr Single-Member P.C. (operator of HERMES PMS, t/a hermespms).
Bizr engages the third parties below to deliver HERMES PMS. Each is a sub-processor of the hotelier’s personal data within the meaning of GDPR Art. 28(2)+(4). This page is the live source of truth — any change is announced to all hoteliers ≥ 14 days before the new sub-processor begins processing, by email and by a dated entry in the change log below.
The hotelier may object to a new sub-processor in writing within 14 days; if the objection cannot be resolved, the hotelier may terminate the affected service.
Infrastructure (data hosting & networking)
| Sub-processor | Role | Personal data processed | Location | Transfer mechanism |
|---|
| Hetzner Online GmbH (Germany) | Application hosting (CX22, Falkenstein) + production database + mail server (4 GB, Falkenstein) + daily snapshots | All HERMES application data: tenants, guests, reservations, ledger, OTA logs, mailbox contents | Falkenstein, DE (EEA) | Intra-EEA |
| Cloudflare, Inc. (US) | DNS authoritative nameservers for hotelier domains + edge proxy for hermespms.com | Domain ownership metadata; no guest data routed through CF for tenant websites (proxy disabled) | Global edge with EU options | EU Standard Contractual Clauses |
| Backblaze, Inc. — B2 EU (Netherlands) | Off-site encrypted backups of the production database (pg_dump daily) | Snapshot of all HERMES data | Amsterdam, NL (EEA) | Intra-EEA |
Payment processing
| Sub-processor | Role | Personal data processed | Location | Transfer mechanism |
|---|
| Stripe Payments Europe Ltd (Ireland) | HERMES subscription billing (the hotelier pays Bizr via Stripe). Tokenized card data; HERMES holds the customer ID only (PCI SAQ-A scope). | Hotelier billing email, business name, AFM, GEMI | Dublin, IE (EEA) | Intra-EEA |
| Viva Wallet Greece, S.A. (Greece) | Guest-payment processing (when the hotelier collects via direct booking). Tokenized card data; HERMES holds the transaction reference only. | Guest name, email, reservation amount; card data is collected client-side directly by Viva. | Athens, GR (EEA) | Intra-EEA |
HERMES never receives, stores, or transmits raw cardholder data. Both Stripe and Viva use client-side tokenization (Stripe.js / Viva Smart Checkout). HERMES PCI scope is SAQ-A.
Mail & communications
| Sub-processor | Role | Personal data processed | Location | Transfer mechanism |
|---|
| Resend.com, Inc. (US — EU region eu-west-1 for HERMES) | Outbound SMTP relay (the hotelier’s reservation confirmations, password resets, support replies leave HERMES via Resend). Per-tenant verified domain. | Recipient email address, subject, body, attachments at the moment of send | eu-west-1 (Ireland) | EU SCCs |
Mailbox storage runs on Bizr-controlled infrastructure (Stalwart Mail Server, Hetzner Falkenstein) and is therefore not a sub-processor; Bizr is the direct operator.
OTA connectivity
| Sub-processor | Role | Personal data processed | Location | Transfer mechanism |
|---|
| Channex.io Ltd (United Kingdom) | Channel manager bridge to Booking.com, Expedia, Trip.com, Agoda and ~144 other OTAs | Guest name, email, phone, dates, room type, total amount for every OTA-sourced reservation | UK | UK GDPR adequacy + Channex DPA |
AI
| Sub-processor | Role | Personal data processed | Location | Transfer mechanism |
|---|
| Anthropic PBC (US) | LLM-assisted drafting (welcome / follow-up messages, stay summaries, task descriptions). Hotelier opt-in at the property level. | Free-form text passed in the prompt — typically guest first name + reservation dates + free-text instructions from the hotelier. No card data, no government ID, no health data. | US (EU API region available on request) | EU SCCs; zero-retention API mode (logs deleted ≤ 30 days, no training on data) |
Observability & support
| Sub-processor | Role | Personal data processed | Location | Transfer mechanism |
|---|
| Functional Software, Inc. (Sentry, US) | Server-side error tracking. HERMES strips PII from stack traces before send. | Stack frames + request URL (without query string); IP and user_id scrubbed | US | EU SCCs |
| Better Stack (Logtail s.r.o., Czech Republic) | Uptime monitoring + log retention (30 days) | HTTP status codes + URLs; no body content | EU | Intra-EEA |
Greek e-invoicing
| Sub-processor | Role | Personal data processed | Location | Transfer mechanism |
|---|
| Elorus, Single-Member P.C. (Greece) | Per-hotelier e-invoicing → AADE/myDATA submission | Invoice debtor name, address, VAT/AFM, line items | Athens, GR (EEA) | Intra-EEA; HERMES is a technical relay — hotelier is the Elorus customer |
Change log
| Date | Change |
|---|
| 2026-05-29 | Initial publication. |