Sub-processors
Public list of vendors that process personal data on behalf of Athleex's PT customers (Art. 28(2) GDPR). Updated whenever a vendor is added or replaced. Push notifications passing through Apple and Google do not contain message content or health data.
Last updated: 2026-09-28
| Vendor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH | Application server, database and uploaded files | Germany (EEA) | No extra-EEA transfer |
| Stripe Payments Europe Ltd. / Stripe, LLC | Payments for web subscriptions | Ireland (EEA) + USA | EU-US Data Privacy Framework (Stripe, LLC) + Standard Contractual Clauses |
| Resend (Plus Five Five, Inc.) | Service emails (sign-in, notifications, alerts) and newsletter with consent | USA | EU-US Data Privacy Framework + Standard Contractual Clauses |
| Meta Platforms Ireland Ltd. | Delivery of WhatsApp and Instagram messages, only if the PT connects those channels | Ireland (EEA) + USA | EU-US Data Privacy Framework (Meta Platforms, Inc.) + Standard Contractual Clauses |
| OpenStreetMap Foundation (Nominatim) | Converting the PT's address into coordinates for the map | United Kingdom | UK adequacy decision |
| Google Ireland Limited / Google LLC | Push notifications on Android (Firebase Cloud Messaging); website statistics only with consent (Google Analytics 4) | Ireland (EEA) + USA | EU-US Data Privacy Framework (Google LLC) + Standard Contractual Clauses |
| Apple Inc. | Push notifications on iPhone (APNs) and in-app purchases on iOS | USA | Standard Contractual Clauses (Apple does not participate in the Data Privacy Framework) |
| Backblaze, Inc. | Off-site backup copy of database and files, encrypted before sending | Netherlands — EU region (EEA) | No transfer outside the EEA (data encrypted before sending; Backblaze also participates in the Data Privacy Framework) |
| Microsoft Ireland Operations Ltd. (Microsoft 365) | The info@athleex.com mailbox: support and requests that PTs and athletes send us | Ireland (EEA) + USA | EU-US Data Privacy Framework (Microsoft Corporation) + Standard Contractual Clauses |
| Microsoft Corporation | Delivery of push notifications in the Edge browser, if enabled: receives a technical address and the encrypted message, which it cannot read | USA | EU-US Data Privacy Framework |
| Mozilla Corporation | Delivery of push notifications in the Firefox browser, if enabled: receives a technical address and the encrypted message, which it cannot read | USA | Service chosen by the browser, not participating in the Data Privacy Framework: sending is necessary to deliver the notifications enabled (Art. 49(1)(b) GDPR) |
When we add or replace a sub-processor we notify customers by email at least 30 days before activation, so they can raise reasoned objections.
Questions or objections: info@athleex.com
Infrastructure and governmental access (Data Act, Art. 28)
The application server, database and files are in Germany with Hetzner Online GmbH, a German company subject to EU law; backups are encrypted on our server before sending and stored in the Netherlands with Backblaze, Inc. (EU region), which does not hold the keys and therefore cannot read them. Against access to or transfer of data requested by third-country authorities in conflict with EU law we take these measures: data and backups in the EU, backup encryption with keys that stay with Refreesh, for vendors outside the EU the Standard Contractual Clauses, which oblige them to inform us of authority requests and to challenge unlawful ones, and an internal rule: we assess every request, answer only if it is based on an international agreement or on EU law, disclose the minimum necessary and, where the law allows, inform the customer.
Third-party credits and licences
To estimate the country from the IP address we use MaxMind's GeoLite2 data, processed on our own server. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
“Find a PT” map: © OpenStreetMap contributors, tiles © CARTO.