Sub-Processor List

1. Introduction

This page lists all sub-processors that BiathlonHub engages to process personal data on behalf of our users, in accordance with GDPR Article 28.

A sub-processor is a third-party data processor engaged by BiathlonHub to assist in fulfilling its obligations to you. We maintain written contracts with all sub-processors requiring them to protect your data to the same standards we apply.

2. Current Sub-Processors

2.1 Infrastructure & Hosting

2.2 Payment Processing

2.3 Email Services

2.4 Analytics (Mobile App)

3. Data Transfer Safeguards

For sub-processors located outside the European Economic Area (EEA), we ensure adequate protection through:

• EU-US Data Privacy Framework: Stripe, Apple, and Google are certified under the EU-US Data Privacy Framework
• Standard Contractual Clauses (SCCs): Where DPF certification is unavailable, we use EU-approved SCCs
• Transfer Impact Assessments: We conduct assessments for transfers to countries without adequacy decisions

4. Sub-Processor Changes

We may update our sub-processors from time to time. When we add a new sub-processor or make material changes:

• This page will be updated
• Users with active Premium subscriptions will be notified via email
• Changes take effect 30 days after notification unless you object

If you object to a new sub-processor, you may terminate your subscription without penalty by contacting us within the 30-day notice period.

5. Data Processing Agreements

We maintain Data Processing Agreements (DPAs) with all sub-processors. These agreements ensure:

• Processing only on our documented instructions
• Confidentiality obligations for personnel
• Appropriate security measures
• Assistance with data subject rights requests
• Deletion or return of data upon termination
• Audit rights and compliance demonstrations

6. Contact

For questions about our sub-processors or to request copies of relevant DPAs: