Courtesy translation: only the French version is legally binding.
Technical subprocessors.
Exhaustive public list of the subprocessors involved in processing your data. Each one is covered by a DPA or by Standard Contractual Clauses for transfers outside the European Union.
7 active subprocessors
Updated: 11 May 2026
Location
🇫🇷France
Data processed
Identity, email, telephone, payments (never pass through us).
Compliance
DPA signed · GDPR · Hosted in France
Long-standing French partner: funds received directly by clubs.
Location
🇺🇸US (SCC)
Data processed
Player identity, confirmed results (explicit consent required). Token encrypted in the database on PickleDeck's side, never read back by the application.
Compliance
Official partnership · SCC · User consent
The player manually enables the DUPR connection from their profile. Can be disabled at any time.
Data transfers outside the European Union
In accordance with article 46 of the GDPR, any transfer of personal data outside the EU is governed by Standard Contractual Clauses (SCC) approved by the European Commission. No transfer is made without an appropriate safeguard.
Stripe (EU/US)
SCC signed · No card data stored at PickleDeck (PCI-DSS Level 1 at Stripe).
Cloudinary (US)
SCC signed · Images only, no identifying data linked to the file.
DUPR (US)
SCC signed · Manual activation by the player (explicit consent). Can be disabled at any time.
Vercel (Global)
SCC signed · No application data persisted (HTTP logs only, anonymised).
No subprocessor reuses your data for commercial purposes. No third-party advertising. No sharing with data brokers.
Adding a new subprocessor
In line with the commitments made in our DPA, every new subprocessor goes through a transparent procedure:
- 1
Prior assessment of necessity (GDPR proportionality)
- 2
Verification of contractual commitments (DPA, SCC if outside the EU)
- 3
Audit of certifications (ISO 27001, SOC 2, PCI-DSS depending on scope)
- 4
Public notification on this page with at least 30 days' notice
- 5
Possibility for institutional clients to object (DPA clause)
A question or need more detail?
For institutions and federations, we provide on request the list of certifications, recent audits and a detailed architecture diagram.