Subprocessor Register

A subprocessor is a third-party service provider engaged by Cluboom to perform specific services that involve personal data on Cluboom’s behalf.

When a club uses Cluboom, the club is normally the controller of its members’ information and Cluboom acts as its processor. Where Cluboom uses another provider — for example to host the database that stores a club’s squad lists — that provider acts as a subprocessor. Subprocessors may only handle information for the purposes Cluboom instructs, and under written terms.

The providers below are the subprocessors currently engaged by Cluboom. Only providers that are genuinely in use are listed.

• Supabase

  Purpose

  Application hosting, authentication, managed PostgreSQL database and secure file storage.

  Data categories

  User account information, authentication data, application data and uploaded files.

  Primary processing region

  United Kingdom / European Economic Area

  Privacy information

  supabase.com/privacy

• Stripe

  Purpose

  Subscription billing and payment processing.

  Data categories

  Billing information and payment transaction metadata.

  Primary processing region

  United Kingdom, European Economic Area and United States

  Privacy information

  stripe.com/gb/privacy

Cluboom does not store full payment card details. Card data is entered directly with the payment provider, which returns only the limited billing and transaction information Cluboom needs to manage a club’s subscription.

No third-party website analytics or advertising provider is currently used on the Cluboom marketing site or in the application. If that changes, this register and the Cookie Policy will be updated before the provider is introduced.

Where a member chooses to enable push notifications, messages are delivered through the push service operated by their own browser or device manufacturer. Cluboom does not select that service on the member’s behalf, and only the technical details required to deliver a notification are sent to it.

Adding a provider means trusting it with information about children, their families and the volunteers who run their clubs. Before engaging any third-party provider, Cluboom considers:

• Security — how the provider protects data in transit and at rest, and how it controls access to it.
• Reliability — whether the service is stable enough for clubs to depend on week to week.
• Privacy — what the provider does with data, and whether it uses it for its own purposes.
• UK GDPR obligations — whether the provider can meet the requirements Cluboom must pass down to it as a processor.
• Industry reputation — the provider’s track record and how it has handled past incidents.
• Contractual safeguards — written data-processing terms, confidentiality obligations and appropriate transfer mechanisms.

A provider that cannot satisfy these considerations is not used, even where it would be convenient to do so.

Cluboom aims to keep club information within the United Kingdom or the European Economic Area wherever practical.

Where a subprocessor processes information outside the UK, Cluboom seeks to ensure that appropriate safeguards are in place in accordance with the UK GDPR — for example a UK adequacy decision, or the International Data Transfer Agreement or UK Addendum to the Standard Contractual Clauses. The primary processing region for each provider is shown in the table above.

Cluboom reviews its subprocessors periodically, and whenever a provider’s role, terms or processing arrangements materially change. Reviews consider whether the provider is still necessary, whether it is still the right choice, and whether the data shared with it remains the minimum required.

This register will change over time as Cluboom evolves. Providers may be added, removed or replaced as features are introduced or retired.

Material changes are reflected through a version update to this document, with a revised effective date. Clubs that need to be told in advance of a change to subprocessors should contact support@cluboom.co.uk so the requirement can be recorded.

• Privacy Policy
• Security Policy
• Data Processing Agreement (UK GDPR)
• Data Retention Policy
• Personal Data Breach Response Procedure

Questions about the providers listed here, or about how Cluboom uses them, can be sent to support@cluboom.co.uk. Feedback on this register is welcome and is used to improve future versions.