List of subprocessors
Last updated: October 12, 2025
Purpose
This document identifies the subprocessors engaged by G.O.A.T Sports AB (“Processor”) to deliver, operate, and support GOATNESS (“the Service”). Each subprocessor may process limited personal data as necessary to perform specific functions on behalf of the Processor.
This document forms an appendix to the Data Processing Agreement (DPA) between G.O.A.T Sports AB and the Customer (Controller).
1. Cloud Infrastructure
Subprocessor | Location | Role / Purpose | Service Used | Data Transfer Outside EU/EEA | Transfer Safeguard |
Microsoft Ireland Operations Ltd. | Ireland | Cloud infrastructure, data hosting, backup, and platform services | Microsoft Azure (App Services, SQL, Storage, Key Vault) | No | Not applicable |
Microsoft Corporation | United States | Support and diagnostics for Azure platform | Azure Support & Security Operations | Yes | Standard Contractual Clauses (SCC) |
2. Communication & Notification Services
Subprocessor | Location | Role / Purpose | Service Used | Data Transfer Outside EU/EEA | Transfer Safeguard |
SendGrid / Twilio Inc. | United States | Delivery of transactional and system emails | Email delivery infrastructure | Yes | SCC + DPA |
Twilio Inc. | United States | Delivery of transactional SMS notifications | SMS delivery platform | Yes | SCC + DPA |
Firebase (Google Ireland Ltd.) | Ireland / Global | Delivery of mobile push notifications | Firebase Cloud Messaging | Yes (potential) | SCC (Google Data Processing Terms) |
3. Analytics & Monitoring
Subprocessor | Location | Role / Purpose | Service Used | Data Transfer Outside EU/EEA | Transfer Safeguard |
Google Ireland Ltd. | Ireland / EU | User analytics, usage statistics | Google Analytics | Yes (limited) | SCC + IP anonymization |
Sentry (Functional Software, Inc.) | United States | Application monitoring, crash and performance analytics | Sentry Cloud Service | Yes | SCC |
MaxMind, Inc. | United States | Geolocation and geo-pricing lookups | MaxMind GeoIP API | Yes | SCC |
4. Payments
Subprocessor | Location | Role / Purpose | Service Used | Data Transfer Outside EU/EEA | Transfer Safeguard |
Stripe Payments Europe Ltd. | Ireland | Payment processing and billing | Stripe Payment Platform | No | Not applicable |
Stripe, Inc. | United States | Backend payment infrastructure and support | Stripe API | Yes | SCC |
5. Customer Support
Subprocessor | Location | Role / Purpose | Service Used | Data Transfer Outside EU/EEA | Transfer Safeguard |
Zendesk, Inc. | United States | Customer support and ticket management | Zendesk Support Platform | Yes | SCC |
6. Change Management
G.O.A.T Sports AB may add, replace, or remove subprocessors from time to time.
Customers will be notified in advance of any intended changes before a new subprocessor is granted access to personal data.
If the Customer objects to a change for legitimate data protection reasons, they may exercise their rights as set out in the Data Processing Agreement (DPA)