Subprocessors

Last updated: 2026-05-22 · v1.0

suPlay BV uses the following subprocessors to operate The Beer Game. Each has signed a GDPR-compliant data-processing agreement with suPlay. We commit to providing at least 30 days’ written notice before adding or replacing a subprocessor; you may subscribe to notifications by emailing privacy@suplay.nl.

Name	Purpose	Data categories	Region	Safeguards
TransIP (team.blue)	VPS hosting (`server01.purchasinggame.com`)	All application data	NL (EU)	EU hosting, DPA
Scaleway SAS	Encrypted off-site backups	All data, GPG-AES256 encrypted at rest before upload	NL (EU, Amsterdam)	EU hosting, DPA, client-side encryption
Resend, Inc.	Transactional email (verification codes, welcome, password reset)	Recipient email, message body	EU (eu-west-1, Ireland)	EU data residency, DPA
Functional Software, Inc. (Sentry)	Application error monitoring	Error traces, request path, authenticated user ID (no game payloads)	EU (Frankfurt, `*.ingest.de.sentry.io`)	EU data residency, DPA, PII scrubbing

Self-hosted services (not subprocessors)

The following services run on suPlay BV’s own infrastructure (TransIP VPS, Netherlands) and are therefore operated by suPlay BV as controller / processor in its own right — they are not subprocessors and no third-party DPA applies.

Service	Purpose	Data categories	Location
MariaDB 10.11 LTS	Primary application database	All application data	NL (EU) — TransIP VPS
Apache httpd + PHP-FPM (PHP 8.2 Remi)	Web tier serving the Symfony application	Transient request / response data	NL (EU) — TransIP VPS

Not used

The Beer Game does not use third-party analytics (no Google Analytics, no advertising trackers, no fingerprinting services), no third-party fonts (fonts are self-hosted), and no CDN that sees user traffic. Embedded media on the landing page (e.g. a YouTube explainer) loads only after the visitor activates it; until activation, a static thumbnail is shown.

Changelog

Date	Version	Change
2026-05-22	v1.0	Initial published list.