Kitman Labs uses third parties to provide infrastructure services, to help us provide customer support, send email and push notifications, and to deliver certain content in a scalable fashion.  These third parties are referred to as “Sub-Processors”.

Prior to engaging any third-party sub-processor, Kitman Labs performs due diligence to evaluate their privacy, security and confidentiality practices, and executes an agreement implementing all applicable obligations.

Subprocessor and location	Description of the services	Categories of Personal Data Processed	International Transfer Mechanism, if applicable
Amazon Web Services Ireland, Ltd. – Ireland	Cloud infrastructure service provider	Customer Data, including staff and athlete data uploaded to or generated within the Services	EU/EEA based – UK adequacy regulations, where applicable
Box (UK) Ltd. – United Kingdom	Cloud storage service provider	Customer Data, including staff and athlete data uploaded to or generated within the Services	UK based – EU adequacy decision, where applicable
Google, LLC. – United States	Cloud infrastructure service provider	Customer Data, including staff and athlete data uploaded to or generated within the Services	EU-US Data Privacy Framework and UK Extension
Google Cloud EMEA Limited – Ireland	Cloud infrastructure service provider; Cloud-based business intelligence services	Customer Data, including staff and athlete data uploaded to or generated within the Services	EU/EEA based – UK adequacy regulations, where applicable
Catamorphic, Co. (LaunchDarkly) – United States	Cloud-based feature flagging services	Staff and athlete user identifiers; limited account metadata	EU-US Data Privacy Framework and UK Extension
Datadog, Inc. – United States	Cloud-based data analytics and dashboarding	User identifiers; IP address; device/browser information; application telemetry and error metadata	EU-US Data Privacy Framework and UK Extension
Dr First, Inc.- United States	Cloud-based e-prescription and medication database services (USA only)	Athlete identifiers and relevant health/clinical data required for the integration	N/A, no transfer under the EU GDPR or UK GDPR
Dynamsoft Corporation – Canada	Web-based document scanning	Scanning Device ID, IP Address (security only)	EU and UK adequacy regulations
Intercom, Inc. – United States	Cloud-based customer support services	Staff name, email address, job title and support communications	EU-US Data Privacy Framework and UK Extension
Functional Software, Inc. (Sentry) – United States	Cloud-based error and exception tracking services	User identifiers; IP address; device/browser information;application telemetry and error metadata	EU-US Data Privacy Framework and UK Extension
Persona Identities, Inc. – United States	Cloud-based document and identity verification services	Name, date of birth, government-issued identity document and identifiers, document image, photograph/selfie, biometric facial data where enabled, device and IP information, identity verification results	EU-US Data Privacy Framework and UK Extension
Redox, Inc. – United States	Cloud-based healthcare integration services. (USA only)	Athlete identifiers and relevant health/clinical data required for the integration	N/A, no transfer under the EU GDPR or UK GDPR
Stripe Payments Europe, Limited – Ireland	Cloud-based payment processing and ecommerce	User/session identifiers, name, payment and transaction information, IP address	EU/EEA based – UK adequacy regulations, where applicable
Tally, BV- Belgium	Cloud-based forms	Administrator defined, IP address (security only)	EU/EEA based – UK adequacy regulations, where applicable
The Rocket Science Group, LLC – United States	Cloud-based email notification services	Name, user identifier, email address, and message content	EU-US Data Privacy Framework and UK Extension
Twilio, Inc. – United States	Cloud-based messaging and push notification services	Name, user identifier, email address, telephone number and message/notification content	EU-US Data Privacy Framework and UK Extension
Urban Airship, Inc. – United States	Cloud-based mobile push notification services	User identifier, mobile device identifier/push token and notification content	EU-US Data Privacy Framework and UK Extension
Zebrafish Labs, Inc. (Imgix) – United States	Cloud-based image CDN services	Staff and athlete profile images and associated identifiers	EU-US Data Privacy Framework and UK Extension