The Aggregator - Sub-Processors
Effective date: 19 August 2026
This page identifies sub-processors engaged by Xyro Gaming Limitada ("The Aggregator") for processing personal data in connection with the Platform, as required by Schedule D of the applicable Operator or Provider Service Offer and Section 5 of the Privacy Policy. The final section additionally identifies providers used for pre-sales enquiries on the public website; those providers process no Operator or Provider Personal Data and fall outside Schedule D.
Intended additions or replacements of generally authorised infrastructure sub-processors are notified to affected Operators and Providers through the Platform dashboard and registered email with at least thirty (30) calendar days' notice before the change takes effect. Game Providers selected by an Operator are specifically authorised as described below.
Current Sub-Processors
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Hetzner Online GmbH | Cloud hosting and data storage | Account data, configuration, metering records, encrypted or pseudonymised technical data | EU (Germany, Finland) |
| Cloudflare, Inc. | CDN, DDoS protection, DNS | IP addresses, request metadata | Global (EU primary) |
| Supabase, Inc. | Database and authentication services | Registration data, session data | EU (Frankfurt) |
| Telegram Messenger LLP | Bot messaging platform | Telegram user IDs, message content | Global |
| Resend, Inc. | Transactional email delivery | Email addresses, notification content | US |
Pre-Sales Demonstration Booking
The service below processes personal data of website visitors who book a demonstration call before registration, as described in Section 3.5 of the Privacy Policy. It processes no Operator or Provider Personal Data and is not a sub-processor under Schedule D of the Operator or Provider Service Offer; it is listed here for transparency.
| Service | Purpose | Data Processed | Location |
|---|---|---|---|
| Cal.com, Inc. | Booking widget embedded on the website; scheduling and hosting of pre-sales demonstration calls | On loading the booking section: IP address, request and device metadata. On booking: name, work email address, company name, selected date, time and time zone, optional note | US |
Operator-Selected Game Providers
A Game Provider becomes a sub-processor for Operator Personal Data only when the Operator selects or enables that Provider and the Provider RGS receives the data solely to execute Provider Content and return transaction or result communications. Before production data is routed, the Operator Workspace displays the Provider's legal identity, relevant Provider RGS or processing location, available international-transfer information, and the categories of data required by that Provider's API. The Operator's selection constitutes specific written authorisation for that Provider. The current Provider is visible in the Operator Workspace for each enabled integration.
An Operator may withdraw this specific authorisation by disabling the Provider before further Player data is routed. The Aggregator shall not enable a different Provider to receive that data without a new Operator selection or another valid documented instruction. A Provider that determines an independent processing purpose is responsible for separately identifying its controller role and applicable privacy information.
Previous Sub-Processors
None. This is the initial version of the sub-processor list.
Objection Process
If you object on reasonable data-protection grounds to an intended infrastructure sub-processor change, contact legal@aggregator.gg within thirty (30) calendar days after notice and before the change takes effect. The affected processing will not begin while a timely objection remains unresolved. We will work in good faith to provide a reasonable alternative, restrict the affected processing, or explain the safeguards. If no reasonable resolution is available, the affected party may terminate the applicable service under the termination clause of its Service Offer. For an Operator-selected Game Provider, the Operator may instead withhold or withdraw authorisation by not enabling or by disabling that Provider.
Contact
- Email: legal@aggregator.gg
- Website: https://aggregator.gg