Service Providers and Technical Services — Palarena
Version 2026-10-14 — publicly updated on October 14, 2026
This page supplements our privacy policy. Recipients receive the data necessary for the services described; our staff’s access is limited to their duties.
Hosting, communication and operations
| Service provider / legal entity | Service and data concerned | Processing locations and safeguards outside the EEA |
|---|---|---|
| OVHcloud — OVH SAS, France | Hosting of the applications, databases and monitoring; business email. Service data, contacts and relevant logs | Servers in France — data protection |
| Cloudflare — Cloudflare, Inc., United States | Delivery and security of the sites, hosting of the website and of contact requests, storage of media and backups; connection data, contacts, media and backed-up service data | Global network; backups stored in the European Union. Transfers: EU–U.S. Data Privacy Framework and standard contractual clauses — DPA |
| Resend — Plus Five Five, Inc., United States | Transactional emails, contact requests and the Clubs’ campaigns; recipient, content and delivery | Sent from the European Union (Ireland); company and account in the United States. Transfers: EU–U.S. Data Privacy Framework and standard contractual clauses — DPA, service providers |
| WhatsApp — WhatsApp Ireland Limited, if the Club uses publishing | Connection of the Club’s account, selected groups and announcements. WhatsApp processes this data for its own service, under its terms | As set out in the WhatsApp privacy policy |
| Calendly — Calendly, LLC, United States | Demo meeting requested; contact details, context and slot | United States. Transfers: EU–U.S. Data Privacy Framework, or standard contractual clauses failing that — privacy, DPA |
French public services answer certain searches: IGN’s Géoplateforme for addresses and the search position, geo.api.gouv.fr for town suggestions in the contact form and the Recherche d’entreprises API for prefilling a Club’s information. They receive the text or position sent for the search, without your name or your email; geo.api.gouv.fr, called from your browser, also receives your browser’s IP address.
Providers that process data on our instructions act as processors; for the Club’s management data, they fall within our Professional Agreement. Their own purposes, in particular regulatory obligations, are their own responsibility.
Payment and authentication
| Service | Role and data | Locations, safeguards and information |
|---|---|---|
| Stripe — Stripe Payments Europe, Limited, Ireland, and the other Stripe entities designated by its terms | Payments to the Club, software subscription and saved payment methods; Stripe receives card data directly. Its role depends on the processing: performance for the professional, but also its own regulatory and security purposes | European Union and United States (Stripe, LLC). Transfers: EU–U.S. Data Privacy Framework and standard contractual clauses — privacy, DPA |
| SumUp — the entity designated by the Club’s SumUp agreement, if the Club connects its SumUp account | Processing of on-site payments on the Club’s account; Palarena sends the request and receives the amount, references and status | As set out in the SumUp privacy policy, the Club’s payment provider |
| Google — Google Ireland Limited, Ireland | Google sign-in if you choose it; identifier and authorized profile. Google also processes your use of its account under its own policy | As set out in Google’s policy; Google LLC applies the EU–U.S. Data Privacy Framework |
Sports payments are made on the Club’s Stripe account, and the Club has its own relationship with this provider. A payment does not amount to commercial consent.
The audience measurement and diagnostics below use tools self-hosted by Palarena; their hosting providers appear above.
Trackers and embedded services
Setting my choices: on the website, the “Cookie settings” link in the footer; in the applications, the “Privacy” settings, or Menu › Legal information › Cookies in the player app.
Trackers strictly necessary for a feature you request do not require agreement when the exemption conditions are met. Other trackers require your prior agreement, with refusal and withdrawal as simple as acceptance. Server-side security logs follow the periods in the privacy policy.
| Service | Purpose | Trigger and choice | Storage or data period |
|---|---|---|---|
| Palarena sign-in | Session and authentication security | Sign-in requested; strictly necessary trackers | Cookies refresh_token (read only by the server) and palarena_auth (session indicator): 60 days, renewed each time the session is refreshed, deleted at sign-out; oauth_state_google during a Google sign-in: 5 minutes at most |
| Cloudflare | Website security and anti-bot check of the contact form | Check loaded when the form opens; strictly necessary, no agreement | No cookies; cf.turnstile.u in the local storage of the verification frame, until cleared by the browser. Cloudflare processes the verification signals to detect bots, under its Turnstile addendum |
| Stripe | Payment, authentication and security | Loaded when a payment or your saved cards are opened; fraud prevention strictly necessary for the requested payment, no agreement | Cookies __stripe_mid: 1 year and __stripe_sid: 30 minutes, on the app’s address; m on m.stripe.com: 2 years; session storage on m.stripe.network: until the tab is closed; hCaptcha anti-bot check called by Stripe: __cf_bm cookie, 30 minutes |
| Calendly | Requested meeting | Loaded only when you open the calendar; security and calendar operation trackers, no agreement; meetings can also be requested by email | Cookies __cf_bm: 30 minutes and _cfuvid: end of the browser session, on calendly.com; Stripe’s m on m.stripe.com: 2 years; _cache in Calendly’s local storage, until cleared by the browser. The meeting is kept under Calendly’s policy |
| Umami | Website audience measurement | Prior agreement; “Cookie settings” to refuse or withdraw | No cookies; choice: 180 days in the browser; statistics: 13 months on our server |
| Grafana Faro | Optional diagnostics: errors, performance and technical sessions | Separate agreement for each application; “Privacy” settings, or Menu › Legal information › Cookies in the player app | Choice: 180 days; session: until the browser session ends; logs and traces: 7 days |
Withdrawing your agreement stops audience measurement and diagnostic data from being sent.
Optional push notifications go through your browser’s or operating system’s service. You can withdraw their permission in its settings; this permission does not amount to commercial consent.
Changes and contact
For data entrusted by the Clubs, the addition or replacement of a subprocessor is subject to the information and the objection period provided for in the Professional Agreement. The successive versions of this list are dated and kept. Clubs can write to contact@palarena.com to exercise this right.
Relevant information about recipients and a copy of the transfer safeguards may be requested from contact@palarena.com, subject to the third-party data and confidential information that must be protected.