Identification
Processor: Wake Up Italy SRL. Document identifier: R.S. The version, effective date and scope are stated in the header of the copy. The initial copy applicable to the Order is the one identified in the Agreement and included in the final PDF.
Scope
This register identifies the external entities to which Wake Up Italy SRL entrusts processing activities on the Client’s behalf under Annex D. Personnel operating under the authority of Wake Up Italy SRL are not listed as separate sub-processors. In-house performance of analysis, design and development activities does not exclude the use of external infrastructure providers.
For each entity, the service used, activity entrusted and data concerned are specified, distinguishing the direct provider from further sub-processors in the chain.
Services used exclusively by Wake Up Italy SRL for its own purposes, such as management of its own administrative relationships, are not presented as the Client’s sub-processors for those operations alone. A service used both for those purposes and on the Client’s behalf is described separately for the latter scope. Services contracted directly by the Client are distinguished from sub-processors appointed by Wake Up Italy SRL.
Entities and activities
Processing chain and transfers
For each service, the register includes, or makes available for retention, the relevant list of further sub-processors with available identifying details and a reference to the version consulted. A link to a dynamic list does not replace retention of the applicable version. The applicable list includes entities relevant to the products used and processing actually entrusted.
The primary region of a database does not, by itself, indicate the location of every operation, technical log, copy, support activity or remote access. The register states the relevant information separately. Applicable transfer instruments are identified according to the contractual relationship, the parties’ roles and the data flows concerned.
Updates
Additions and replacements follow the procedure in Annex D8.2, including written notification, the right to object and the conditions for any shorter notice period. Merely updating this page does not replace the communication required by the Agreement. The addition of a new entity or service remains subject to the same procedure.
The current version and previously published versions are available at https://siti.gratis/legale/subresponsabili. Subsequent changes do not alter the initial copy retained with each Order; applicable updates are documented separately.
Cloudflare, Inc.
- Legal name
Cloudflare, Inc.
- Service used
Cloudflare Workers with Workers Static Assets: hosting, routing execution and distribution of the public SITE/SHOP frontend, with processing of the technical data necessary for web requests (IP, URL, HTTP method and headers, technical browser and security information). Operations include transmission, routing, protection, response and technical logging provided for by the configuration. Published content may include data supplied by the Client. Separately, within the siti.gratis platform, D1 stores structured Project management and preparation data, and R2 stores materials, files and builds. The standard frontend configuration does not include a dedicated persistent visitor database. Any additional functions and processing are documented before activation.
- Registered office and country
101 Townsend Street, San Francisco, California 94107, USA
- Data protection contact
dpo@cloudflare.com
- Position in the chain and appointing entity
Direct provider to Wake Up Italy SRL.
- Scope of use under the Order
Infrastructure included in the Agreement.
- Processing activity entrusted
Publication and distribution of website files; handling of web requests. Storage of Project materials and resources in the working platform.
- Categories of personal data
IP addresses and technical web request data, within the limits of the configured service. Personal data contained in Project materials entrusted by the Client.
- Categories of data subjects
Visitors and users of the Client’s website. Persons whose data are contained in materials entrusted by the Client.
- Main storage countries
European Union for the D1 database and R2 objects configured with EU jurisdiction. Logs, email and support are subject to the locations of their respective services. (https://developers.cloudflare.com/r2/reference/data-location/)
- Other countries of processing and remote access
Cloudflare international network and its sub-processors, limited to the services used. Request processing and support access may also take place outside the EU. The relevant countries and entities are stated in the Cloudflare list for the respective services. (https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services/)
- Configured region and limits of the indication
D1: EU jurisdiction, primary region EEUR, read replication disabled. R2: private bucket with EU jurisdiction. Workers: distributed network, with possible execution outside the EU.
- Applicable processing agreement and version
Cloudflare Data Processing Addendum, published version 6.4, effective from 3 April 2026, referred to by the Self-Serve Subscription Agreement: https://www.cloudflare.com/cloudflare-customer-dpa/
- Instrument applicable to transfers outside the EEA
Cloudflare DPA mechanisms for applicable flows: Data Privacy Framework where applicable; standard contractual clauses for transfers subject to those safeguards, with the module corresponding to the parties’ roles.
- Applicable further sub-processors and list version
Google LLC — Cloudflare Developer Platform, according to the Cloudflare list updated on 1 October 2025 and consulted on 27 September 2026; Oracle America, Inc. — Cloudflare Developer Platform, according to the Cloudflare list; Cloudflare Group — Account assistance and technical support within Cloudflare services, according to the applicable list; Slack Technologies, Inc.; Zendesk, Inc.; Salesforce, Inc. — Cloudflare support and account management within their respective scopes. List and locations: https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services/
- Retention and deletion relevant to the service
The Client’s materials are retained for performance of the Agreement and in accordance with its documented instructions; return and deletion follow Annex D and the exit rules. The Supplier undertakes to make separate copies of the database and files every week and before substantial changes, retain them for 30 days and test restoration every quarter. Native D1 recovery is additional. The 30-day period concerns the backup copies described; logs and data processed by Cloudflare for its own purposes are subject to their respective retention periods.
- Information verification date
2026-09-27