Sub-processors

A team that uses Atlea is the data controller for what its players and staff enter. Atlea is its processor, and the companies below are Atlea’s sub-processors — they hold or carry that data so the service can run. The relationship is set out in the Privacy Policy and in the data processing agreement each team signs.

There are three, and all team data is stored in Ireland. Atlea uses no analytics, advertising, session-recording or customer-support provider, and runs no third-party script in the application that could observe a player’s answers.

What it does

Stores the database, runs sign-in and account management, and holds uploaded files such as a team crest.

Data it processes

All data a team enters, including health data: check-in answers, reported pain and body area, current status, rehabilitation records, staff assessments and the clinical notes attached to them.

Where the data is stored

Ireland — AWS eu-west-1.

Contracting entity

Supabase Pte. Ltd, 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513.

Transfer safeguard

Standard Contractual Clauses, incorporated into the Supabase data processing addendum.

What it does

Serves the web application and runs the server functions behind it.

Data it processes

Data passing through the application while a page is being served, and server request logs. It does not hold a copy of the database.

Where the data is processed

Server functions run in Dublin. Static files such as images and stylesheets are served from the nearest edge location worldwide; those contain no personal data.

Contracting entity

Vercel Inc., a Delaware corporation, 440 N Barranca Ave #4133, Covina, CA 91723, USA.

Transfer safeguard

Standard Contractual Clauses (Commission Decision 2021/914), incorporated into the Vercel data processing addendum.

What it does

Delivers the service’s email: invitations, password resets and notifications.

Data it processes

Name, email address and the content of those messages. No health data and no check-in answers are ever sent by email.

Where the data is processed

Ireland — Resend’s EU region, AWS eu-west-1.

Contracting entity

Plus Five Five, Inc., trading as Resend, 2261 Market Street #5039, San Francisco, CA 94114, USA.

Transfer safeguard

EU and UK Standard Contractual Clauses, incorporated into the Resend data processing addendum. Their own sub-processors are listed at resend.com/legal/subprocessors.

Supabase and Resend both run on Amazon Web Services in the eu-west-1 (Ireland) region. AWS is a sub-processor of those two providers rather than of Atlea directly, and is covered by their agreements. It is named here because a team’s data protection officer will reasonably want to know whose hardware the data sits on.

The Atlea Check-in app is distributed through the Apple App Store and Google Play, and receives updates through Expo’s update service. Those services deliver the application itself; the app then talks directly to Supabase. They receive no team data and are therefore not sub-processors. They are named here so that their absence is understood to be deliberate.

Atlea gives every team at least 30 days’ written notice before adding or replacing a sub-processor, and this page is updated at the same time.

A team may object on reasonable data protection grounds within those 30 days. If the objection cannot be resolved, the team may end the affected part of its subscription without penalty and receive a pro rata refund for the unused term. Write to info@atlea.ai.