Sub-processors
Draft
This page is a draft, written from the code and server configuration on 14 October 2026. It has not been reviewed by a lawyer yet and is not ready to sign. It describes what Clubkit actually does today; open gaps are marked open.
Annex 2 to the data processing agreement: the services Clubkit uses to process your club's data.
In use
| Service | Company, seat | Purpose | Data | Location |
|---|---|---|---|---|
| Hosting | Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | The server Clubkit runs on (database, sync, API, club websites, images, backups) | all data in DPA clause 2.4 | Germany |
| Email delivery | Resend, Inc., USA | Invitations, password emails, announcements and reminders by email | recipients' email address and name, email content | EU (Ireland): sent via Amazon SES, region eu-west-1; Resend itself is a US company; safeguard: standard contractual clauses (check DPF certification) |
| Push service | 650 Industries, Inc. ("Expo"), USA | Forwards push notifications to Apple and Google | device push token, notification text | USA; safeguard: (check SCCs / DPF) |
| Push delivery iOS | Apple Inc., USA (Apple Push Notification service) | Delivers push notifications to iPhones | push token, notification text | USA (check role and safeguard) |
| Push delivery Android | Google LLC, USA / Google Ireland Ltd. (Firebase Cloud Messaging) | Delivers push notifications to Android devices | push token, notification text | EU/USA (check role and safeguard) |
For information: services without club data
These services are involved but receive no personal data of the club. They are listed for completeness.
| Service | Company | Purpose | Note |
|---|---|---|---|
| Domain and DNS | Cloudflare, Inc., USA | Domain clubkit.team, name resolution, proof for TLS certificates | DNS only. Traffic does not pass through Cloudflare (no proxy). |
| TLS certificates | Internet Security Research Group (Let's Encrypt), USA | Issues the HTTPS certificates | No user data. |
| App updates | 650 Industries, Inc. ("Expo"), USA | Delivers app updates (EAS Update) and builds the app (EAS Build) | When fetching an update Expo sees the device's IP address and app version, no club data. |
| App stores | Apple (App Store), Google (Google Play) | Distribute the app | Separate controllers towards users; no club data. |
Not in use
No analytics, tracking, advertising or error-reporting services (e.g. no Google Analytics, no Sentry). No payment services: the database has fields for a future payment provider, unused today.
Planned
- Offsite backup: a second storage location (S3-compatible, e.g. Hetzner Object Storage) is planned but not set up. It will be added here before it goes live and announced to clubs under DPA clause 7.2.