Sub-processors
Who else touches the data, and what they get
Version 1.0 · In effect from 20 August 2026
1. About this list
A sub-processor is a company that processes personal data on our behalf so that we can run the platform. Each one is under contract, may use the data only for the service it provides to us, and is bound by obligations no less protective than those in our Data Processing Agreement.
Some entries below are switched off unless you consent to them — the analytics and marketing ones. Those receive nothing at all from visitors who decline, and nothing at all from the club management or trainer areas regardless of consent.
2. Infrastructure
| Provider | Purpose | Data received | Location |
|---|---|---|---|
| Runs the application and database | All platform data |
3. Communications
| Provider | Purpose | Data received | Location |
|---|---|---|---|
| Zoho Corporation B.V. | Transactional email — verification, password reset, invitations | Email address, name, message content | European Union |
| SMS Club | SMS booking reminders, confirmations and verification codes | Phone number, message text | Ukraine |
| Google Ireland Ltd (Firebase Cloud Messaging) | Push notifications to the mobile app | Device token, notification title and body | European Union / United States |
4. Payments
| Provider | Purpose | Data received | Location |
|---|---|---|---|
| Processing subscription payments | Payment amount, currency, order reference. Card details go directly to the provider and never reach us. |
5. Analytics and marketing
These run only with your consent, and never in the club management or trainer areas.
| Provider | Purpose | Data received | Location |
|---|---|---|---|
| Google Ireland Ltd (Google Analytics 4) | Aggregate usage statistics for the public website | Pseudonymous identifier, pages viewed, approximate location, device type | European Union / United States |
| Smartsupp.com, s.r.o. (Smartlook) | Session replay on the public website, to find confusing layouts | Page interactions. Form input, numbers, email addresses and IP addresses are excluded by configuration. | European Union |
| Meta Platforms Ireland Ltd | Measuring advertising effectiveness, in the browser and server-side | Pseudonymous identifier, IP address, browser user agent; email and phone in hashed (SHA-256) form only | European Union / United States |
6. Sign-in providers
| Provider | Purpose | Data received | Location |
|---|---|---|---|
| Google Ireland Ltd | “Sign in with Google”, if you choose it | Google learns that you signed in to Horsika; we receive your account identifier, email, name and profile picture | European Union / United States |
| Apple Distribution International Ltd | “Sign in with Apple”, if you choose it | Apple learns that you signed in to Horsika; we receive your account identifier and, if you allow it, your email | European Union / United States |
7. Notice of changes
We give clubs at least 30 days' notice before adding or replacing a sub-processor, so that there is time to object under section 6 of the Data Processing Agreement.
To be notified, write to privacy@horsika.com and we will add you to the list.
Questions about this document: privacy@horsika.com. Our other legal documents: Terms of Use, Privacy Policy, Cookie Policy, Data Processing Agreement, Sub-processors, Refunds & Withdrawal, Imprint.