Sub-processors
Updated 3 September 2026
This list is an annex to the data processing agreement between XenGolf Oy and a golf club. It states which service providers process personal data on XenGolf's behalf in the Impact service (app.xengolf.fi, the Impact Golf mobile app, the club administration view) and on the website www.xengolf.fi. Changes are notified to club customers in accordance with the data processing agreement. General description of processing: Privacy Policy.
1. Sub-processors
| Sub-processor | Location | Purpose of processing | Data processed | Transfer mechanism |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL | Luxembourg; data centre Stockholm (eu-north-1). Content delivery edge locations in Europe and North America; TLS certificate and firewall in us-east-1 | Hosting: database, files (profile and competition images, feedback images), logs, usage analytics (CloudWatch RUM), processing of email and contact forms, technical alerts | All personal data in the service; IP address and browser data in logs | Processing in the EU. For edge locations: EU-U.S. Data Privacy Framework and AWS Standard Contractual Clauses |
| Resend, Inc. | USA | Sending the service's emails (verifications, password resets, competition and results notices, Golf ID codes, membership applications, feedback) | Recipient email address, name, message content | Emails may be dispatched from the EU, but Resend account data, message metadata and logs are stored in the United States. EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses |
| Paytrail Oyj | Finland | Payment services for competition and entry fees. Card details are processed only in the systems of Paytrail and the payment method providers. As a payment institution Paytrail retains payment data for five years by law and is an independent controller to that extent | Payer name, email address, phone number, payment amount and items | Processing in the EU. Paytrail's data processing agreement is an annex to the payment service agreement |
| Slack Technologies, LLC (Salesforce) | USA | XenGolf's internal notifications: website contact and newsletter forms, error log alerts, payment alerts, usage statistics | Form name, club, email and message; error log content; payment references | EU-U.S. Data Privacy Framework |
| Google Ireland Ltd / Google LLC | Ireland / USA | Google Analytics 4 on the website (with consent only); Firebase library in the Android app and Firebase Cloud Messaging for push notifications. Google Fonts are loaded directly by the browser | Cookie identifiers, anonymised IP, browser data; app installation identifier and push token; IP address when loading fonts | EU-U.S. Data Privacy Framework |
| GitHub, Inc. (Microsoft) | USA | Source code management and development tickets. Does not intentionally contain service personal data; individual identifiers may appear in support tickets | Occasional identifiers in support tickets | EU-U.S. Data Privacy Framework |
| Tailscale Inc. | Canada / USA | Encrypted remote access for operations to the database. Traffic is end-to-end encrypted; Tailscale sees connection metadata only | Connection metadata (device, user, time) | Canada adequacy decision; Standard Contractual Clauses |
| Anthropic, PBC | USA | Code review of development tickets and a troubleshooting tool for XenGolf's technical staff (restricted superuser access). The troubleshooting connection currently targets the development environment only; a production connection will be added with separate notice. The service does not send user data to Anthropic automatically, and data is not used to train AI models | Individual records inspected during troubleshooting (e.g. user, payment, log) | EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses |
2. Independent Controllers and Third Parties
The following parties are not sub-processors. They either process data on their own behalf when a player uses the service, or are third parties that the user's browser calls directly without XenGolf disclosing any data stored in the service to them. They are listed for completeness.
| Party | Location | Role | Data transferred |
|---|---|---|---|
| Finnish Golf Union (eBirdie, Golf ID) | Finland | National player and handicap register; source of club member registers | Golf ID person identifier, name, membership, handicap, handicap round scores, marker name |
| Google LLC | USA | Google sign-in; Google Play app store | Sign-in identifier, email, name |
| Apple Inc. | USA | Apple sign-in; App Store and TestFlight; Apple Health (on-device storage of Watch rounds) | Sign-in identifier, email (or relay address), name; Health data stays on the device |
| Vimeo.com, Inc. | USA | Delivery of the intro video on the website (Do Not Track mode, no cookies) | IP address, browser data |
| jsDelivr (Prospect One) | Poland | Delivery of the cookie banner and icon libraries on the website | IP address, browser data |
| Open-Meteo | Germany | Weather data in the web app's course view; fetched directly from the browser | IP address, course coordinates |
3. Change History
- 3 September 2026: List published. Resend replaced Amazon SES for email delivery. Firebase Cloud Messaging added for the upcoming push notification feature. Vimeo, jsDelivr, Open-Meteo, GitHub, Tailscale and Anthropic added. Paytrail classified as a sub-processor in line with Paytrail's own privacy notice.