Legal
Sub-processors
This page is under review. The providers, regions and safeguards below are what we actually use today, and we will post the reviewed version here when it is ready.
This page lists the third-party sub-processors Infacta uses to process personal data on behalf of the clubs, societies and organisations that use Infacta Account and the Infacta products: ClubCards, FloorTime and CampGenie. It forms part of our Data Processing Agreement as Annex 3. Infacta is a registered business name of Groupmail Ltd. (registered in Ireland, company no. 284930, registered office Unit 15, SocoLab, Strandhill, Co. Sligo, F91 E426, Ireland).
Where your data is hosted
Infacta Account and every Infacta product run their application and PostgreSQL database in the European Union — Render’s Frankfurt (Germany) region, on Google Cloud infrastructure. Uploaded files and generated artifacts are stored either in Amazon S3 in the EU (Frankfurt, eu-central-1) or on the application’s own EU storage, depending on the product — the table says which. Personal data is processed in the EU by default.
Where a sub-processor is based outside the EEA or the UK, the transfer is covered by the European Commission’s 2021 Standard Contractual Clauses, and by the UK International Data Transfer Addendum for UK data.
The list
| Provider | What it does | Where it processes | Entity location | Transfer safeguard | Used by |
|---|---|---|---|---|---|
| Render Services, Inc. | Application hosting, compute and managed PostgreSQL database | EU — Frankfurt, Germany, on Google Cloud | USA | Standard Contractual Clauses, in Render’s DPA | Infacta Account, ClubCards, FloorTime, CampGenie |
| Amazon Web Services, Inc. | Object storage (Amazon S3) for uploaded images and generated files | EU — Frankfurt, Germany (eu-central-1) | USA | Standard Contractual Clauses, in the AWS DPA | ClubCards, FloorTime |
| Postmark (ActiveCampaign, LLC) | Transactional email delivery — invitations, sign-in links, credential emails, registration confirmations and a club’s messages to its people | USA | USA | Standard Contractual Clauses; Postmark also publishes EU-specific data-protection terms | Infacta Account, ClubCards, FloorTime, CampGenie |
| Google LLC | Google Wallet — creating a member’s wallet pass sends the holder name, club name, credential status and validity to Google’s Wallet API | USA / global | USA | Standard Contractual Clauses, in Google’s DPA | ClubCards |
| Stripe | Payment processing, on the Club’s own connected Stripe account | EU and USA | Ireland and USA | Standard Contractual Clauses for any processing outside the EEA/UK | ClubCards, CampGenie |
Amazon S3 is listed for ClubCards and FloorTime because they are the products that store uploaded files there. CampGenie stores its club logos on the application’s own EU storage instead, so it has no S3 processing to declare.
Stripe is a little different from the others. Payments are taken on the Club’s own connected Stripe account, so the Club has its own relationship with Stripe and its own Stripe terms; we list Stripe here because order data passes through it in the course of providing the product. FloorTime takes no payments at all and so has no payment sub-processor.
Apple Wallet is not a sub-processor
A member’s Apple pass (.pkpass) is generated on our EU servers and downloaded directly to their device. We do not transmit member data to Apple in order to create the pass, so Apple does not act as a sub-processor of member data.
Sign-in is ours, not a third party’s
Accounts and sign-in are handled by Infacta Account at id.infacta.com, which Infacta operates itself. It is not a third-party sub-processor: it is the same operator under the same agreement, and its own processing is described in Annex 1 of our Data Processing Agreement.
Changes to this list
We will give at least 30 days’ notice before adding or replacing a sub-processor, by updating this page and notifying account administrators, so that controllers can raise any reasonable, data-protection-based objection as set out in our Data Processing Agreement.
Contact
Questions about our sub-processors? Email us at hello@infacta.com.