Applicable infrastructure
The registered offices of the parties involved, the countries of storage and processing, relevant remote access and applicable transfer mechanisms are described in the version of the subprocessor register that applies to the Order. The dependency register identifies the services and contractual arrangements. Copies of these documents can be retained with the Agreement.
This page reproduces, from the same verified register, the table of services, entities, registered offices, countries and transfer mechanisms. Selecting a European region for one component does not amount to a general guarantee that processing takes place exclusively within the European Economic Area.
Safeguards and access requests
Wake Up Italy SRL processes the entrusted data on the Client’s behalf in accordance with documented instructions and Annex D. Access is restricted to authorised persons and providers within the scope of their respective activities. The measures actually adopted and the relevant provider safeguards are stated in the verified configuration information sheet; technical options that have not been confirmed as activated are not attributed to the Project.
A request from an authority in a third country is not, by itself, regarded as sufficient to make a disclosure lawful. The request undergoes legal review as to jurisdiction, binding effect, applicable legal basis, necessity and proportionality; Annex D9 and mandatory obligations apply. Where permitted, the Client is informed; where the relevant conditions are met, available remedies are pursued and disclosure is limited to the data lawfully requested. No absolute absence of requests or legally compelled access is promised.
For clarification, the Client may contact Wake Up Italy SRL using the privacy contact specified in the Agreement. Updates to this page do not replace the notices and authorisations required to change the processing chain.
Services, locations and transfer safeguards
The entries describe processing entrusted by the Supplier to the parties in the stated version of register R.S. Services contracted directly by the Client and their respective terms are identified separately in dependency register R.D.
- Entity and service
Cloudflare, Inc.
101 Townsend Street, San Francisco, California 94107, USA
Cloudflare Workers with Workers Static Assets: hosting, routing execution and distribution of the public SITE/SHOP frontend, with processing of the technical data necessary for web requests (IP, URL, HTTP method and headers, technical browser and security information). Operations include transmission, routing, protection, response and technical logging provided for by the configuration. Published content may include data supplied by the Client. Separately, within the siti.gratis platform, D1 stores structured Project management and preparation data, and R2 stores materials, files and builds. The standard frontend configuration does not include a dedicated persistent visitor database. Any additional functions and processing are documented before activation.
- Activities and data
Publication and distribution of website files; handling of web requests. Storage of Project materials and resources in the working platform.
IP addresses and technical web request data, within the limits of the configured service. Personal data contained in Project materials entrusted by the Client.
Visitors and users of the Client’s website. Persons whose data are contained in materials entrusted by the Client.
- Storage
European Union for the D1 database and R2 objects configured with EU jurisdiction. Logs, email and support are subject to the locations of their respective services. (https://developers.cloudflare.com/r2/reference/data-location/)
- Processing and access
Cloudflare international network and its sub-processors, limited to the services used. Request processing and support access may also take place outside the EU. The relevant countries and entities are stated in the Cloudflare list for the respective services. (https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services/)
- Applicable region
D1: EU jurisdiction, primary region EEUR, read replication disabled. R2: private bucket with EU jurisdiction. Workers: distributed network, with possible execution outside the EU.
- DPA and transfer safeguards
Cloudflare Data Processing Addendum, published version 6.4, effective from 3 April 2026, referred to by the Self-Serve Subscription Agreement: https://www.cloudflare.com/cloudflare-customer-dpa/
Cloudflare DPA mechanisms for applicable flows: Data Privacy Framework where applicable; standard contractual clauses for transfers subject to those safeguards, with the module corresponding to the parties’ roles.
- Further subprocessors
Google LLC — Cloudflare Developer Platform, according to the Cloudflare list updated on 1 October 2025 and consulted on 27 September 2026; Oracle America, Inc. — Cloudflare Developer Platform, according to the Cloudflare list; Cloudflare Group — Account assistance and technical support within Cloudflare services, according to the applicable list; Slack Technologies, Inc.; Zendesk, Inc.; Salesforce, Inc. — Cloudflare support and account management within their respective scopes. List and locations: https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services/