Legal
Sub-processors
This page is under review. The providers, regions and safeguards below are what we actually use today, and we will post the reviewed version here when it is ready.
This page lists the third-party sub-processors Infacta uses to process personal data on behalf of the clubs, societies and organisations that use Infacta Account and the Infacta products: ClubCards, FloorTime and CampGenie. It forms part of our Data Processing Agreement as Annex 3. Infacta is a registered business name of Groupmail Ltd. (registered in Ireland, company no. 284930, registered office Unit 15, SocoLab, Strandhill, Co. Sligo, F91 E426, Ireland).
Where your data is hosted
Infacta Account and every Infacta product run their application and PostgreSQL database in the European Union — Render’s Frankfurt (Germany) region, on Google Cloud infrastructure. Uploaded files and generated artifacts are stored either in Amazon S3 in the EU (Frankfurt, eu-central-1) or on the application’s own EU storage, depending on the product — the table says which. Personal data is processed in the EU by default.
Where a sub-processor is based outside the EEA or the UK, the transfer is covered by the European Commission’s 2021 Standard Contractual Clauses, and by the UK International Data Transfer Addendum for UK data.
The list
| Provider | What it does | Where it processes | Entity location | Transfer safeguard | Used by |
|---|---|---|---|---|---|
| Render Services, Inc. | Application hosting, compute and managed PostgreSQL database | EU — Frankfurt, Germany, on Google Cloud | USA | Standard Contractual Clauses, in Render’s DPA | Infacta Account, ClubCards, FloorTime, CampGenie |
| Amazon Web Services, Inc. | Object storage (Amazon S3) for uploaded images and generated files | EU — Frankfurt, Germany (eu-central-1) | USA | Standard Contractual Clauses, in the AWS DPA | ClubCards, FloorTime, CampGenie |
| Postmark (ActiveCampaign, LLC) | Transactional email delivery — invitations, sign-in links, credential emails, registration confirmations and a club’s messages to its people | USA | USA | Standard Contractual Clauses; Postmark also publishes EU-specific data-protection terms | Infacta Account, ClubCards, FloorTime, CampGenie |
| Google LLC | Google Wallet — creating a member’s wallet pass sends the holder name, club name, credential status and validity to Google’s Wallet API | USA / global | USA | Standard Contractual Clauses, in Google’s DPA | ClubCards |
| Stripe | Payment processing, on the Club’s own connected Stripe account | EU and USA | Ireland and USA | Standard Contractual Clauses for any processing outside the EEA/UK | ClubCards, CampGenie |
| Cloudflare, Inc. | Bot check (Turnstile) on the invitation-request form at id.infacta.com — receives the IP address and browser details of whoever opens the form, never data a club enters | USA / global | USA | Standard Contractual Clauses, in Cloudflare’s DPA | Infacta Account (invitation-request form only) |
Amazon S3 is listed for the products that store uploaded files there: ClubCards, FloorTime, and CampGenie, which keeps its club logos and the photos in a camp’s album there.
Stripe is a little different from the others. Payments are taken on the Club’s own connected Stripe account, so the Club has its own relationship with Stripe and its own Stripe terms; we list Stripe here because order data passes through it in the course of providing the product. FloorTime takes no payments at all and so has no payment sub-processor.
Cloudflare is listed so this page names every provider, not because it processes data on a club’s behalf. It checks that the invitation-request form at id.infacta.com is being filled in by a person rather than a bot, so the only people whose data it sees are those asking for an invitation, whose data Infacta controls itself. It never receives anything a club enters, which is why adding it did not need the notice described under Changes to this list. Our Privacy Policy says what it receives.
Apple Wallet is not a sub-processor
A member’s Apple pass (.pkpass) is generated on our EU servers and downloaded directly to their device. We do not transmit member data to Apple in order to create the pass, so Apple does not act as a sub-processor of member data.
Sign-in is ours, not a third party’s
Accounts and sign-in are handled by Infacta Account at id.infacta.com, which Infacta operates itself. It is not a third-party sub-processor: it is the same operator under the same agreement, and its own processing is described in Annex 1 of our Data Processing Agreement.
Changes to this list
We will give at least 30 days’ notice before adding or replacing a sub-processor, by updating this page and notifying account administrators, so that controllers can raise any reasonable, data-protection-based objection as set out in our Data Processing Agreement.
Contact
Questions about our sub-processors? Email us at hello@infacta.com.