Overview
Kolva Club (“we”, “us”, “our”) uses a limited number of third-party sub-processors to deliver and operate the platform. As a data processor acting on behalf of sports clubs (the data controllers), we are committed to transparency about who has access to personal data and why.
This page lists all sub-processors currently authorised to process personal data on our behalf, in accordance with our Data Processing Agreement (DPA) and applicable data protection legislation including the UK GDPR, EU GDPR, and the Data Protection Act 2018.
Change Notification
We will notify club administrators at least 30 days before adding or changing sub-processors. Notifications are sent by email to the primary administrator on the account. If you object to a new sub-processor, you may contact us within that notice period to discuss your concerns or exercise your rights under the DPA.
Current Sub-processors
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Hetzner Cloud Hetzner Online GmbH | Infrastructure hosting, database hosting, storage of uploaded files | All Club Data, including uploaded documents | Finland (EU) |
| Stripe Stripe Payments Europe Ltd | Card payment processing via Stripe Connect | Parent name, email, payment amounts, transaction records. Card details processed directly by Stripe. | EU / US (adequate jurisdiction + SCCs) |
| GoCardless GoCardless Ltd | Direct Debit payment processing via GoCardless Connect | Parent name, email, bank details (processed by GoCardless), payment amounts, mandate references | UK |
| Mollie Mollie B.V. | Payment processing via Mollie Connect for Platforms, for clubs that connect a Mollie account (not yet switched on for clubs generally) | Parent name, email, bank/card details (processed by Mollie), payment amounts, mandate references | Netherlands (EU) |
| Resend Resend Inc | Sending transactional email, and receiving replies sent to club reply addresses | Sender and recipient email addresses, email content (may include names) | US (SCCs / UK IDTA in place) |
| Google Google LLC | AI features (Gemini API), including the AI inbox assistant when a club has it on and the reading of staff certificates; “Sign in with Google”; maps shown on club websites; web push notifications | AI: the text of your request and the club data needed to answer it (for example names, ages, team assignments, and medical details when an administrator asks about them), plus the content of inbound emails and portal messages while the AI inbox assistant is on. Staff certificates: the image or PDF an administrator uploads for the system to read. Sign-in: name, email address and Google account identifier. Maps: the visitor’s IP address and browser details when a page with a map is viewed. Push: the title and text of the notification. | US / global (may be outside the UK and EEA) |
| Apple and Mozilla Apple Inc., Mozilla Corporation | Web push notification delivery on Apple and Firefox devices (Google’s push service is covered in the Google row) | The title and text of the notification, and the device’s push address | US / global |
| Anthropic Anthropic, PBC | AI features (Claude): the help chat (which is open to visitors who are not signed in), policy review and Smart Import of spreadsheets | Messages typed into the help chat. For Smart Import, sample rows from the spreadsheet you upload, which may include names, contact details and any medical columns it contains. | US (may be outside the UK and EEA) |
| AssemblyAI AssemblyAI, Inc. | Speech-to-text for the voice feature | Microphone audio, streamed from your browser when you use voice | US (may be outside the UK and EEA) |
| Cartesia Cartesia AI, Inc. | Text-to-speech for the voice feature | The text of the assistant’s reply, so it can be read aloud | US (may be outside the UK and EEA) |
| OpenAI OpenAI, L.L.C. | Text-to-speech for the voice feature (used if Cartesia is unavailable) | The text of the assistant’s reply, so it can be read aloud | US (may be outside the UK and EEA) |
| Cloudflare Cloudflare, Inc. | CDN, DNS and proxy in front of the site, and bot protection (Turnstile) on forms | Site traffic metadata (including visitor IP addresses) as it passes through Cloudflare; the Turnstile token and browser details when you use a form that includes the check | US / global |
Nightly backups of the database and uploaded files are copied to storage that Kolva controls in the United Kingdom. This is our own storage rather than a separate sub-processor.
International Data Transfers
Transfers of personal data outside the UK or the European Economic Area are subject to UK GDPR Article 46 and EU GDPR Chapter V.
For US-based sub-processors (Resend, Google, and Cloudflare), we rely on the following transfer mechanisms:
- Standard Contractual Clauses (SCCs) – EU-approved model clauses incorporated into our agreements with each sub-processor.
- UK International Data Transfer Agreement (UK IDTA) – the UK addendum to the SCCs, ensuring transfers comply with UK data protection law.
- EU–US Data Privacy Framework – where the sub-processor is certified under the framework, this provides an additional adequacy basis for EU–US transfers.
Stripe processes data within the EU via Stripe Payments Europe Ltd. Where data may transit through US infrastructure, Stripe relies on SCCs and the EU–US Data Privacy Framework. AI requests to Google’s Gemini API are not restricted to EU servers, so they may be processed outside the UK and EEA.
Anthropic, AssemblyAI, Cartesia and OpenAI are US companies, and the data we send them may be processed outside the UK and EEA.
Questions
If you have questions about our sub-processors or wish to raise an objection to a proposed sub-processor change, please contact us: