Legal
Sub-processors
Last updated: 5 November 2026
KantaPass uses the following sub-processors to process card holders' data. Customers are notified of changes 30 days in advance.
| Sub-processor | Task | Card holder data processed | Location | Transfer basis |
|---|---|---|---|---|
| Supabase Pte. Ltd (Singapore) | Database and file storage | All data in annex A of the data processing agreement | Stockholm, Sweden | Standard contractual clauses |
| Google Cloud EMEA Ltd (Ireland) | Backend, scheduled jobs, logs, backups | All annex A data while being processed; backups; request logs (IP address, browser, URL) | Backend, backups and logs in Finland | Standard contractual clauses and DPF |
| Netlify Inc. (United States) | Delivery of the card page and website | IP address, browser details, requested page | Global network, served to Finland from Frankfurt | Standard contractual clauses and DPF |
| Cloudflare Inc. (United States) | Relaying Apple Wallet updates, DNS | Device ID, push token, pass file (including first name). Not logged | Global network, served to Finland from Helsinki | DPF, with standard contractual clauses as fallback |
| Resend (United States) | Sending email | Email address, name, one-time recovery code, delivery data | Sent from Ireland; account and log data in the United States | Standard contractual clauses and DPF |
| Apple Inc. (United States) | Apple Wallet push notifications | Push token only. The notification is empty | Global, United States | DPF |
| Google (Google Wallet API) | Creating Android cards and messages | Card design, stamp count, card code, the customer's messages. No name, email or phone number | Global | DPF |
| Google (Fonts) | Card page font | IP address, browser details | Global | DPF |
| Microsoft 365 (via GoDaddy) | Company mailboxes | Only what customers or card holders send us by email | EU | Standard contractual clauses and DPF |
When a card holder adds the card to their wallet, Google stores the Google Wallet card in the card holder's Google account, and Apple keeps a copy if the card holder syncs their wallet with iCloud. For this, Apple and Google process data under the card holder's own agreements with them and are not KantaPass's sub-processors.
DPF means the EU-US Data Privacy Framework. Standard contractual clauses are the clauses adopted by the European Commission (Decision (EU) 2021/914).
Related documentsData Processing Agreement (annex 1 to the Terms of Service)