Golf Consult AS · Organisation no. 922 561 095
Service providers
Providers, processing roles and international operations.
Published 19 October 2026 · Version 2026-10-29-live-1
Service providers and roles
Golf Consult AS uses the services below to operate bukk.io. The first six providers perform functions covered by the customer DPA where they process customer content on our behalf. Some also act independently for their own account, service-security or legal-compliance data, as explained in their notices.
The primary application and database region is Frankfurt, Germany. Global delivery, messaging, security and support can involve processing outside the EEA, including the United States. The linked provider documents describe their processing, subprocessors and transfer provisions. The DPA requires appropriate agreements and lawful safeguards for the actual processing. Contact support@bukk.io for customer-specific information; this register is not a claim of EU-only processing or an independent compliance certification.
Vercel — application hosting
Vercel hosts the application, API and content delivery. It receives application content and technical request data needed to serve and secure the service. The application’s main compute region is Frankfurt; CDN, security and support operations use Vercel’s international infrastructure.
The standard Vercel DPA applies to customer-content processing on Pro and Enterprise plans; bukk.io uses Pro. It contains contractual transfer safeguards for relevant international transfers. Vercel separately determines some account and service-data processing.
Neon / Databricks — database
Neon stores application records, including accounts, building permissions, bookings and subscription references, in PostgreSQL. The primary database is in AWS Frankfurt, Germany. Account, support and other provider operations may involve locations outside that region.
The standard Neon product schedule refers to the Databricks Master Cloud Services Agreement, which incorporates its DPA. The DPA provides Standard Contractual Clauses for relevant restricted transfers. Frankfurt storage does not exclude international support or subprocessor access.
Twilio — verification and SMS
Twilio receives mobile numbers, verification or message content and delivery metadata for sign-in and service messages. Processing can involve Twilio’s international infrastructure and the recipient’s telecommunications network. Twilio has separate controller activities for certain account, communications-usage and security data.
Twilio’s DPA forms part of its service agreement. Its transfer schedule distinguishes applicable Binding Corporate Rules and Standard Contractual Clauses by service and transfer. Telecommunications providers may have their own responsibilities and are not all Twilio subprocessors.
Cloudflare — Turnstile security
Turnstile receives browser and network signals on registration and guest checkout to distinguish genuine users from automated abuse. Cloudflare operates a global network. Its Turnstile-specific privacy notice describes the security processing alongside its customer data-processing terms.
Cloudflare’s Self-Serve Subscription Agreement incorporates its DPA for the covered processing. For Turnstile, Cloudflare acts as processor when securing our website and as an independent controller when improving its bot-detection service. Its DPA includes Standard Contractual Clauses for relevant restricted transfers.
Vercel Blob — room images
Vercel Blob stores and delivers uploaded room images. Primary storage is configured in Frankfurt; public delivery, technical request processing and support use international infrastructure. Anyone with an image link can retrieve that image, including images used for private company rooms. Do not upload confidential material or unnecessary personal information.
New uploads are resized and re-encoded, with original filenames and embedded metadata removed. Replacing or removing an image detaches it from the room. Files awaiting deletion and unreferenced uploads older than one day are processed by a bounded background cleanup job. Failed deletions remain queued for retry and operational follow-up. Provider and browser caches may retain a copy temporarily; public recipients may retain their own copies. The Vercel Pro DPA covers customer-content processing under the applicable agreement.
Resend — transactional email
Resend (Plus Five Five, Inc.) delivers service email using recipient addresses, message content and delivery metadata. Its primary processing operations are in the United States. Transactional delivery is distinct from optional marketing.
Resend’s DPA is incorporated into its Terms of Service. It provides Standard Contractual Clauses for relevant restricted transfers, including processor-to-subprocessor transfers where the building customer is controller.
Paddle — independent subscription payments
Paddle is merchant of record and reseller for the bukk.io software subscription. It processes buyer, tax, payment, fraud-prevention and subscription information as an independent controller. bukk.io receives the identifiers and status needed to manage the selected building’s subscription. Paddle does not collect room-hire or catering payments through this subscription.
External content and customer-selected services
OpenFreeMap supplies Explore maps. Public images may be served by Vercel Blob. Loading this content sends technical browser-request data to those services. Do not include private booking details in public listings.
Buildings may select providers such as Vipps and PowerOffice for room payments or accounting, or suppliers for booking extras. Users may connect an AI agent. Those choices and the applicable provider relationships are controlled by the customer or user; the relevant provider’s terms and privacy information also apply.
You can save or print this page using your browser. The version above identifies these documents.