Subprocessors and supplier roles.
The suppliers SwimNexus uses, what each one does, and which services belong to your club rather than to us. The contractual Subprocessor Schedule in your document centre is the authoritative list.
Last updated: 20 October 2026
Suppliers used by SwimNexus
| Supplier | What it does | Information involved | Location | Status |
|---|---|---|---|---|
| Cloudflare Supplier appointed by SwimNexus; verification in progress | DNS, tunnel and edge protection. Published hosting path | Traffic and request metadata. Extent not verified. | Not verified | In use; verification in progress |
| Google Supplier appointed by SwimNexus | Google Drive encrypted cloud backup. Storage of locally encrypted backup files | Encrypted backup copies of tenant data | Not verified | In use; verification in progress |
| mailbox.org Supplier appointed by SwimNexus | Platform SMTP. Delivery of SwimNexus service email | Recipient address and the content of that service email | Not re-verified beyond the configured SMTP host smtp.mailbox.org | In use, approved |
| Microsoft Supplier appointed by SwimNexus | Microsoft OneDrive encrypted cloud backup. Storage of locally encrypted backup files | Encrypted backup copies of tenant data | Not verified | In use; verification in progress |
| SwimNexus hosting SwimNexus infrastructure | Windows, XAMPP and MariaDB. Primary hosting of platform and tenant databases | All categories the club enters | Described by the operator as the United Kingdom. Not independently certified in this record. | Not a SwimNexus subprocessor |
- Cloudflare provides connectivity (Cloudflare Tunnel) and processes website traffic. It does not host SwimNexus operational databases or member documents as primary storage. Depending on configuration it may keep technical logs or cached content.
- Microsoft OneDrive and Google Drive hold backups that are encrypted on the hosting computer before upload. They are used for offsite backup, not for running the service.
- mailbox.org delivers SwimNexus service email such as invitations and notices.
- Where a supplier's location or international-transfer terms are shown as not yet verified, we say so rather than imply they are settled.
Services your club controls
These are your club's own arrangements. They are not SwimNexus subprocessors merely because the product can connect to them. For example, your club may use its own GoCardless account or its own Microsoft 365 subscription.
| Service | Role | Note |
|---|---|---|
| GoCardless | Arranged by the club | Optional club payment collection. Not used unless the club connects its own account |
| Microsoft 365 | Arranged by the club | Optional club email or files. Only where the club holds the tenant |
Changes and notice
Under the Data Processing Agreement SwimNexus gives customers at least 14 days' notice of a new subprocessor or a material change before it processes club personal data, and a chance to object on data-protection grounds. Notices go to each club's owners and administrators.
No change notices have been issued.
Legal & policies · Security & Data Protection · Privacy Policy