Subprocessor and Third-Party Provider Register
Travel Desk operator: Matthew King trading as Travel Desk, Suite RA01, 195-197 Wood Street, London, E17 3NU, United Kingdom.
| Provider | Role / purpose | Operational state |
|---|---|---|
| Fasthosts | Website/application/database hosting and related infrastructure. | Operational |
| Backblaze B2 | Encrypted verified backup storage. | Operational |
| Stripe | Hosted subscription/payment checkout, billing status and transaction metadata. | Configured; paid checkout remains governance-gated |
| Postmark | Transactional and permitted service email delivery where configured. | Operational/conditional by message path |
| OpenAI | AI processing for enabled content/workflow features deliberately invoked by the user/system. | Operational for enabled AI features |
| Meta (Facebook / Instagram) | Connected social platform for OAuth and authorised publishing/status operations. For ordinary Platform API use Meta is treated as a separate platform controller under the Meta Platform Terms, not as an Article 28 Travel Desk subprocessor. Where Travel Desk processes an agent's connected Platform Data solely on that agent's instructions, Travel Desk's customer processing terms apply to that Travel Desk/agent relationship. | Operational for connected accounts |
| TikTok | OAuth connection and authorised Content Posting/status operations. | Operational for connected accounts; public Direct Post remains provider-audit dependent |
| EasyCron | External scheduling of bounded Travel Desk cron endpoints. | Operational scheduler; endpoint secrets are not published here |
| CJdropshipping | Product discovery/sourcing and potential fulfilment for Agent Shop merchandise. | Sourcing integration active; orders/payments/activation remain disabled |
| Prodigi | Potential personalised merchandise pricing/fulfilment. | Sandbox/conditional; live order adapter disabled |
| Diginate | Potential personalised sticker/product fulfilment. | Pricing/integration conditional; live order route not launch authority |
| Treat Pod | Potential personalised merchandise integration. | Read-only/conditional; order creation disabled |
| Printful | Legacy/conditional print-on-demand provider integration. | Conditional; not treated as automatically approved for live processing |
| Airalo | Potential eSIM catalogue/provisioning for agent-facing digital products. | Conditional; provider activation required |
| Make.com | Optional automation/webhook workflows where specifically configured. | Conditional |
Role clarification: this page intentionally includes both subprocessors and independent/connected third-party controllers. A provider listed here is not automatically a Travel Desk subprocessor. Meta Platform Data is governed by Meta Platform Terms, including the applicable controller-to-controller transfer provisions; advertising/Custom Audience terms are not used as a substitute for ordinary connected-account publishing.
Transfers and due diligence
The non-public owner governance register records or flags for review the contracting entity, processing location, controller/processor role, contract/DPA status, transfer mechanism (if needed), transfer risk assessment / data protection test status, security review and review date for each provider before that provider is treated as fully approved for the relevant processing. A provider appearing in source code or on this public register is not evidence that contractual or transfer due diligence has been completed.
UK launch approval rule
Operational integration does not by itself approve a provider for every category of data or jurisdiction. The UK launch governance record must identify the actual processing purpose, contracting role, data location, transfer position and due-diligence status before a provider is treated as approved for that use. Non-UK commercial activation remains disabled pending separate review.
Changes and objections
Where Travel Desk acts as processor and relies on general authorisation for subprocessors, material changes should be communicated through an appropriate customer notice mechanism. Customers with a genuine data-protection objection should contact support@traveldeskshop.com.