Klubio Sub-processors
The Klubio platform is operated by Qbit Software OÜ ("Klubio"); "Klubio" is a trademark of Klubio LLC (Wyoming, USA), used under licence. To deliver the platform, Qbit Software OÜ engages a small number of third-party service providers ("sub-processors") that may Process personal data on behalf of our customers (clubs and associations). This page lists those sub-processors. It forms part of our Data Processing Agreement and is incorporated into it by reference.
We require every sub-processor to be bound by written contractual data-protection obligations no less protective than those we owe our customers, and — where a sub-processor processes data outside the European Economic Area (EEA) — to provide an appropriate transfer safeguard under Chapter V GDPR (such as the European Commission's Standard Contractual Clauses).
Infrastructure sub-processors
These are used for all customers.
Hosting and object storage
Provider: DigitalOcean, LLC
Purpose: hosting of the application, database and storage of uploaded files (e.g. documents, medical attachments).
Data location: Amsterdam (ams3), Netherlands, EEA
Transfer safeguard: data hosted within the EEA; where the provider's parent entity is outside the EEA, Standard Contractual Clauses apply.
Transactional email
Provider: Postmark (operated by Wildbit, LLC / ActiveCampaign)
Purpose: sending and delivering transactional and notification emails (e.g. invoices, training updates, account emails); delivery, open and click tracking of those emails.
Data processed: recipient email address, name, and the content of the email.
Data location: United States
Transfer safeguard: Standard Contractual Clauses (per the provider's Data Processing Addendum). DPA and SCCs on file
Payment processing
Provider: Maksekeskus AS
Purpose: processing online payments for invoices and memberships.
Data processed: payer name, email, payment amount and reference. Card/bank credentials are handled by the payment processor and are not stored by Klubio.
Data location: Estonia (EEA)
Transfer safeguard: within the EEA
Optional sub-processors (only if a club enables them)
These process personal data only for clubs that switch on the corresponding accounting integration.
Accounting integration — Merit Aktiva
Provider: Merit Tarkvara OÜ (Merit Aktiva)
Purpose: synchronising invoices and payments with the club's accounting software, where the club has enabled this integration.
Data processed: customer/member name, contact details and invoice line data.
Data location: Estonia (EEA)
Transfer safeguard: within the EEA.
Accounting integration — Excellent Books
Provider: Excellent Books OÜ
Purpose: synchronising invoices and payments with the club's accounting software, where the club has enabled this (legacy) integration.
Data processed: customer/member name, contact details and invoice line data.
Data location: Estonia (EEA)
Transfer safeguard: within the EEA.
Changes to this list
We will update this page before engaging a new sub-processor or replacing an existing one, giving customers the opportunity to object on reasonable data-protection grounds as set out in our Data Processing Agreement.