Klubio Sub-processors
The Klubio platform is operated by Klubio OÜ ("Klubio"); "Klubio" is a trademark of Klubio LLC (Wyoming, USA), used under licence. To deliver the platform, Klubio OÜ engages a small number of third-party service providers ("sub-processors") that may Process personal data on behalf of our customers (clubs and associations). This page lists those sub-processors. It forms part of our Data Processing Agreement and is incorporated into it by reference.
We require every sub-processor to be bound by written contractual data-protection obligations no less protective than those we owe our customers, and — where a sub-processor processes data outside the European Economic Area (EEA) — to provide an appropriate transfer safeguard under Chapter V GDPR (such as the European Commission's Standard Contractual Clauses).
Infrastructure sub-processors
These are used for all customers.
Hosting and object storage
Provider: DigitalOcean, LLC
Purpose: hosting of the application, database and storage of uploaded files (e.g. documents, medical attachments).
Data location: Amsterdam (ams3), Netherlands, EEA
Transfer safeguard: data hosted within the EEA; where the provider's parent entity is outside the EEA, Standard Contractual Clauses apply.
Transactional email
Provider: Postmark (operated by Wildbit, LLC / ActiveCampaign)
Purpose: sending and delivering transactional and notification emails (e.g. invoices, training updates, account emails); delivery, open and click tracking of those emails.
Data processed: recipient email address, name, and the content of the email.
Data location: United States
Transfer safeguard: Standard Contractual Clauses (per the provider's Data Processing Addendum).
Email delivery
Provider: Amazon Web Services EMEA SARL (Amazon Simple Email Service)
Purpose: sending and delivering platform emails (e.g. club messages, account emails, invoices and login codes); delivery, bounce and complaint tracking of those emails.
Data processed: recipient email address, name, and the content of the email.
Data location: Frankfurt (eu-central-1), Germany, EEA
Transfer safeguard: data processed within the EEA; where the provider's parent entity is outside the EEA, Standard Contractual Clauses apply.
Error monitoring
Provider: Functional Software, Inc. (trading as Sentry)
Purpose: capturing application errors and crashes in the web and mobile apps, so faults affecting members can be detected and fixed.
Data processed: technical diagnostic data: error message and stack trace, browser and device type, application version, the page being viewed, the club identifier, and an internal numeric user id. Names, email addresses, telephone numbers, personal identification codes and access tokens are removed before transmission. A short recording of the moments preceding an error may also be captured, in which all on-screen text, form input and media are masked before leaving the device, so the recording shows page structure and interaction only and no readable personal data. Recording is never continuous and is discarded unless an error occurs.
Data location: European Union (Sentry EU data region)
Transfer safeguard: data stored within the EEA; where the provider's parent entity is outside the EEA, Standard Contractual Clauses apply.
Payment processing
Provider: Maksekeskus AS
Purpose: processing online payments for invoices and memberships.
Data processed: payer name, email, payment amount and reference. Card/bank credentials are handled by the payment processor and are not stored by Klubio.
Data location: Estonia (EEA)
Transfer safeguard: within the EEA
Optional sub-processors (only if a club enables them)
These process personal data only for clubs that switch on the corresponding accounting integration.
Accounting integration — Merit Aktiva
Provider: Merit Tarkvara OÜ (Merit Aktiva)
Purpose: synchronising invoices and payments with the club's accounting software, where the club has enabled this integration.
Data processed: customer/member name, contact details and invoice line data.
Data location: Estonia (EEA)
Transfer safeguard: within the EEA.
Accounting integration — Excellent Books
Provider: Excellent Books OÜ
Purpose: synchronising invoices and payments with the club's accounting software, where the club has enabled this (legacy) integration.
Data processed: customer/member name, contact details and invoice line data.
Data location: Estonia (EEA)
Transfer safeguard: within the EEA.
Changes to this list
We will update this page before engaging a new sub-processor or replacing an existing one, giving customers the opportunity to object on reasonable data-protection grounds as set out in our Data Processing Agreement.