FootballHome
Back to home

FootballHome Subprocessor List

Last updated: 22 October 2026.

This list accompanies the Data-Processing Agreement between the Club and PSG, Borut Grauf s.p. It identifies providers used for processing on the Club's behalf. Some providers also support the operator's separate controller activities described in the Privacy Notice.

Providers

Contabo GmbH

  • Function: application hosting and storage of databases and uploaded files.
  • Location: Germany, EU.
  • Data: Club information stored in the Service, including member and guardian records, activity data, communications, website content, files and related technical records.
  • Transfer arrangements: the listed hosting location is in the EEA. Any additional processing outside the EEA must be covered by the applicable provider agreement and transfer safeguards.

Scaleway SAS

  • Function: transactional email delivery, including invitations, sign-in messages and Club-requested service notifications.
  • Location: France, EU.
  • Data: recipient addresses and names where supplied, message content and delivery metadata.
  • Transfer arrangements: the listed delivery infrastructure is in the EEA. Further restricted transfers require the applicable safeguards.

Cloudflare, Inc.

  • Function: domain/network services, proxying and content delivery, TLS, security and abuse protection, relevant traffic/performance information, and encrypted off-site backup storage. Bot protection is included where enabled.
  • Location: a US-established provider operating a global network. Edge and security processing may occur outside the EEA. Backup objects use R2's EU-jurisdiction storage.
  • Data: IP addresses, request URLs and headers, device/browser details, security signals, content passing through the network, relevant traffic metrics and encrypted backup archives.
  • Transfer arrangements: Cloudflare's applicable DPA and Standard Contractual Clauses; an adequacy framework may apply where the recipient and processing qualify. Additional safeguards include encryption of backup contents before upload.

Changes and objections

We notify affected Clubs in writing at least 14 days before an additional or replacement subprocessor begins processing their data. The notice identifies the provider, role, location and proposed effective date. A Club may object on reasonable data-protection grounds during that period. The DPA explains resolution and termination rights.

Direct invoices and other services

This list covers the directly invoiced FootballHome service. JoinSport's Paddle billing is addressed in JoinSport's own documents. A payment provider's independent-controller role must not be described as processing all payment data solely on the Club's instructions.

Questions about providers or transfer safeguards: support@footballhome.app.