Sub-processors — updated 10 September 2026

Thu, 10 Sep 2026 00:00:00 +0000

Last updated: 10 September 2026

LootLocker uses a small number of service providers to operate the LootLocker platform. Each one processes personal data only on our instructions, under a written agreement that imposes the obligations required by Article 28 of the GDPR.

This page is Exhibit A to our Data Processing Agreement and forms part of it. It is the authoritative version of the list, and it supplies the sub-processor information required by Annex III to the Standard Contractual Clauses.

Providers we use to deliver the Service

Provider	What they do	Personal data involved	Where it is processed	Provider established in
Hetzner Online GmbH	Hosting, compute, networking, caching — our primary infrastructure	All customer and player data stored in the platform	Helsinki, Finland (hel-1)	Germany
Cloudflare	Content delivery, DDoS protection	IP addresses and request metadata in transit	Global edge network	United States
Grafana Cloud (Grafana Labs)	Metrics and monitoring	Operational metrics; IP addresses in logs	London, United Kingdom	United States
Postmark (ActiveCampaign)	Transactional email — account and system messages	Email addresses, message content	United States	United States
Lettermint	Campaign and newsletter email	Email addresses, subscription status, engagement data	Netherlands	Lettermint B.V., Netherlands

Providers we use to run our business

Provider	What they do	Personal data involved	Where it is processed	Provider established in
Google Workspace	Internal communication and document storage	Customer contact details and correspondence	United States	United States
Discord	Our public developer support community	Discord account identifiers and messages of people who choose to join	Global	United States

Recipients that act as independent controllers

Some providers decide for themselves how they use personal data, so they are not our processors. We name them here because customers ask, not because they are sub-processors.

Recipient	What they do	Personal data involved	Role
Stripe	Invoicing and payment collection	Billing contact details, company details, VAT number, invoice and payment records. Card details are entered directly with Stripe and never reach LootLocker	Independent controller under its own privacy policy

Stripe handles our own billing data. It never receives player data, which is why it does not appear in Exhibit A to the Data Processing Agreement — that exhibit covers only sub-processors of data we handle on a customer's behalf.

Discord and Twitch integrations. LootLocker offers integrations with Discord (rewards and key distribution) and Twitch (drops). Neither processes LootLocker customer data on our behalf, so neither is a sub-processor for that purpose. Where a customer connects its own Discord server or Twitch channel, that platform acts under its own terms and its own relationship with the customer and the player.

International transfers

Player data in the platform is hosted and stored in the EEA, on Hetzner in Helsinki, Finland.

Grafana Cloud processes monitoring data in London. The United Kingdom is covered by a European Commission adequacy decision, so no additional transfer safeguard is required.

Transfers to the United States — Postmark, Google Workspace, Discord, Cloudflare's global edge network and Stripe — are made under the Standard Contractual Clauses adopted by the Commission in Implementing Decision (EU) 2021/914, with the UK International Data Transfer Addendum or the equivalent Swiss provisions where those apply.

Changes to this list

We update this page when we add or replace a sub-processor.

Under our Data Processing Agreement, a customer may object on reasonable grounds relating to data protection within fourteen (14) days of an update. We will discuss any objection in good faith, and where it cannot be resolved the customer may terminate the affected Services. If no objection is raised in that period, the sub-processor is treated as authorised.

To be notified of changes, subscribe to the RSS feed on this page.

Questions

privacy@lootlocker.com