About this page
Gitogi Srl, Piazza IV Novembre 4, 20124 Milano, Italy, VAT and tax identification number 14288420962, uses external services for the Website, its business and, depending on the project, client services.
Last updated: 16 September 2026.
This English version is provided for convenience. If the language versions conflict, the Italian version prevails, without limiting your statutory rights.
This page is the public provider register: it describes services, entities and available information on locations and transfers. The Privacy policy describes the data categories and purposes. Client projects also require the specific list provided for in the DPA.
Website suppliers
Suppliers involved in website services. The data they receive depends on the features you use and, where required, your consent.
Vercel
Website hosting, content delivery and server functions.
- Company
- Vercel Inc. (USA)
- Data processed
- Request data, including IP addresses, browser details and requested pages; technical data and form and chat content handled by server functions.
- Processing locations
- Server functions in Frankfurt, EU; content delivery through a global network.
- Transfer safeguards
- Transfers governed by the standard contractual clauses in Vercel's DPA, using the applicable module.
The server-function region does not establish that every operation in the service chain takes place in the EU.
Supabase
Website database and administrator authentication.
- Company
- Supabase Pte. Ltd. (Singapore)
- Data processed
- Contact requests, commercial contact records, newsletter subscriptions, conversations, consent and acknowledgement logs, AI technical logs, rights-request data and administrator accounts.
- Processing locations
- Database in AWS eu-central-1, Frankfurt, EU; contractual importer in Singapore.
- Transfer safeguards
- DPA incorporating module 2 standard contractual clauses for the Singapore importer; Frankfurt storage does not exclude third-country access.
Conversations have no IP or browser fields; choice logs separately contain a pseudonymised IP fingerprint and browser information.
Amazon Web Services (Bedrock)
Only with your consentRunning Claude Sonnet and, alternatively, Mistral Large for Gitogi AI.
- Company
- Amazon Web Services EMEA SARL (Lussemburgo / Luxembourg)
- Data processed
- Messages and context supplied to the model, and generated responses.
- Processing locations
- Inference in the European Union through AWS Bedrock EU profiles.
- Transfer safeguards
- The described inference takes place in the EU. Any transfers relating to other operations in the service chain require an applicable safeguard, such as an adequacy decision or standard contractual clauses.
Under the Bedrock terms, AWS does not retain content or use it for training. Gitogi separately stores conversations. Project use requires project-specific assessment and authorisation.
Resend
Sending Website confirmations, subscription emails, verification codes and internal notifications; the configured newsletter delivery service.
- Company
- Plus Five Five, Inc. (USA)
- Data processed
- Email addresses, message content and delivery outcomes. Contact-request notifications include supplied details, a telephone number where provided and a chat extract.
- Processing locations
- Sending region in Ireland; main processing in the United States.
- Transfer safeguards
- EU-U.S. Data Privacy Framework for covered transfers; standard contractual clauses under the applicable DPA.
Open and click tracking disabled. No newsletters had been sent as at 15 September 2026.
Upstash
Request rate limiting to prevent abuse.
- Company
- Upstash, Inc. (USA)
- Data processed
- Identifiers pseudonymised using HMAC-SHA-256 with a secret key and temporary counters; control windows of up to 24 hours.
- Processing locations
- Database in AWS eu-west-2, London, United Kingdom; US provider.
- Transfer safeguards
- UK adequacy decision; for US transfers, the Data Privacy Framework where applicable and standard contractual clauses where not covered.
Upstash statistics are disabled. Fingerprints are pseudonymised data, not anonymous data or reversibly encrypted IP addresses.
PostHog
Only with your consentUsage analytics, interaction capture and possible session recording, with analytics consent.
- Company
- PostHog, Inc. (USA)
- Data processed
- Pseudonymous identifiers, page views, interactions, device technical data and possible session recordings with masked inputs.
- Processing locations
- PostHog EU Cloud; US provider.
- Transfer safeguards
- Data hosted in the EU; Data Privacy Framework for covered US transfers and standard contractual clauses under the DPA.
Activation requires analytics consent. Input masking does not make all collected data anonymous.
Sentry
Error and performance diagnostics; session recording only with analytics consent.
- Company
- Functional Software, Inc. (USA)
- Data processed
- Technical error and performance data with filters to remove email and IP addresses; with consent, recordings with text, fields and media masked.
- Processing locations
- EU data region in Germany; US provider.
- Transfer safeguards
- Data hosted in the EU; Data Privacy Framework for covered US transfers and standard contractual clauses under the DPA.
Diagnostics are always active on the basis of legitimate interests. Analytics consent separately enables session recording.
Google Analytics e reCAPTCHA v3
Google Analytics 4: analytics with consent. reCAPTCHA v3: protecting forms against automated requests and abuse.
- Company
- Google Ireland Limited
- Data processed
- Analytics: identifiers, browsing activity and technical data. reCAPTCHA v3: IP address, browser and device characteristics and interactions.
- Processing locations
- EU and United States, depending on the service.
- Transfer safeguards
- Data Privacy Framework for covered recipients and transfers; standard contractual clauses in the terms applicable to each service.
Analytics uses basic consent mode. reCAPTCHA loads on interaction with public forms and immediately on administrator sign-in pages. Analytics terms do not replace the Google Cloud terms for reCAPTCHA.
Google Workspace
Business email, work and calendar tools, call bookings and Google Meet meetings.
- Company
- Google Cloud Italy S.r.l. (Italia / Italy)
- Data processed
- Emails and attachments, including Website notifications and contact requests with chat extracts; work content, appointments and participant data.
- Processing locations
- EU and United States; an EU-only data residency configuration is not established.
- Transfer safeguards
- Data Privacy Framework for covered recipients and transfers; standard contractual clauses under the applicable Google Workspace DPA.
Email copies have retention separate from Website database records. Project use must comply with client agreements and instructions.
Suppliers for Gitogi's business
Suppliers involved in running the business. They may process data about clients, prospective clients, suppliers and their contacts, according to the service and role described.
Google Workspace
Business email, work and calendar tools, call bookings and Google Meet meetings.
- Company
- Google Cloud Italy S.r.l. (Italia / Italy)
- Data processed
- Emails and attachments, including Website notifications and contact requests with chat extracts; work content, appointments and participant data.
- Processing locations
- EU and United States; an EU-only data residency configuration is not established.
- Transfer safeguards
- Data Privacy Framework for covered recipients and transfers; standard contractual clauses under the applicable Google Workspace DPA.
Email copies have retention separate from Website database records. Project use must comply with client agreements and instructions.
OpenAI (ChatGPT Business e Codex)
Business tools supporting work, drafting and software development.
- Company
- OpenAI (servizi business / business services)
- Data processed
- Content submitted to the business tools. This entry neither establishes nor authorises processing of clients' personal data.
- Processing locations
- Depends on the service, contract and configuration; this entry does not establish EU data residency.
- Transfer safeguards
- Before any personal data transfer, the contract must establish an applicable safeguard, such as standard contractual clauses or an adequacy decision; this entry does not establish the mechanism in the executed contract.
Business terms exclude use of data for training. The EEA contracting entity must be identified from the contract; listing does not constitute authorisation as a project's sub-processor.
Odoo
Business management of clients, proposals and invoices.
- Company
- Odoo S.A. (Belgio / Belgium)
- Data processed
- Identification and contact details in business records and commercial and accounting documents.
- Processing locations
- For Odoo Cloud's Europe region: production in France and Belgium; backups in France, the Netherlands and Sweden. Versions before 19 may retain an additional Canadian backup during transition.
- Transfer safeguards
- For any Canadian backups, adequacy applies only to recipients within the decision's scope; otherwise applicable safeguards, such as standard contractual clauses, are required. The version and configuration determine the actual flow.
Odoo S.A. acts as processor for databases hosted on Odoo Cloud. The Europe-region description does not, by itself, confirm Gitogi's hosting, region or database version.
Aruba PEC
Provision of the certified email mailbox.
- Company
- Aruba PEC S.p.A. (Italia / Italy)
- Data processed
- Certified email messages, attachments and transmission and receipt information.
- Processing locations
- Italy, for the certified email service described in the register.
- Transfer safeguards
- The stated processing in Italy does not require a non-EEA transfer mechanism; any additional flows must be assessed under the applicable contract.
The provider's service role must be distinguished from any independent statutory obligations under the applicable terms.
Suppliers in client projects
Their involvement depends on the project. They are sub-processors when Gitogi engages them to process data on the client's behalf, under the DPA and applicable authorisations; using a client's account does not by itself determine their role.
Amazon Web Services (Bedrock)
Only with your consentRunning Claude Sonnet and, alternatively, Mistral Large for Gitogi AI.
- Company
- Amazon Web Services EMEA SARL (Lussemburgo / Luxembourg)
- Data processed
- Messages and context supplied to the model, and generated responses.
- Processing locations
- Inference in the European Union through AWS Bedrock EU profiles.
- Transfer safeguards
- The described inference takes place in the EU. Any transfers relating to other operations in the service chain require an applicable safeguard, such as an adequacy decision or standard contractual clauses.
Under the Bedrock terms, AWS does not retain content or use it for training. Gitogi separately stores conversations. Project use requires project-specific assessment and authorisation.
Google Workspace
Business email, work and calendar tools, call bookings and Google Meet meetings.
- Company
- Google Cloud Italy S.r.l. (Italia / Italy)
- Data processed
- Emails and attachments, including Website notifications and contact requests with chat extracts; work content, appointments and participant data.
- Processing locations
- EU and United States; an EU-only data residency configuration is not established.
- Transfer safeguards
- Data Privacy Framework for covered recipients and transfers; standard contractual clauses under the applicable Google Workspace DPA.
Email copies have retention separate from Website database records. Project use must comply with client agreements and instructions.
OpenAI (ChatGPT Business e Codex)
Business tools supporting work, drafting and software development.
- Company
- OpenAI (servizi business / business services)
- Data processed
- Content submitted to the business tools. This entry neither establishes nor authorises processing of clients' personal data.
- Processing locations
- Depends on the service, contract and configuration; this entry does not establish EU data residency.
- Transfer safeguards
- Before any personal data transfer, the contract must establish an applicable safeguard, such as standard contractual clauses or an adequacy decision; this entry does not establish the mechanism in the executed contract.
Business terms exclude use of data for training. The EEA contracting entity must be identified from the contract; listing does not constitute authorisation as a project's sub-processor.
Processors, sub-processors and other recipients
The role follows the actual processing:
- where Gitogi is the controller, a provider processing on its behalf is a processor; see the Privacy policy;
- where Gitogi is a processor for a client, another party entrusted with part of that processing may be a sub-processor;
- a party independently determining purposes and means may be a separate controller;
- LinkedIn Page Insights involves the joint controllership described in the Privacy policy.
Processor and sub-processor relationships must comply with Article 28 GDPR. This page does not replace the required agreements or, by itself, establish that every agreement has been completed.
Services and scope
| Scope | Services | Qualifications |
|---|---|---|
| Website infrastructure | Vercel, Supabase, Upstash | Server functions and Supabase database in Frankfurt; Upstash database in London. These locations do not exclude other access or transfers |
| Website email | Resend | Main processing in the United States; sending region in Ireland |
| Gitogi AI | Amazon Web Services Bedrock | Claude Sonnet and Mistral Large run in the EU; no direct APIs from other model providers |
| Analytics and diagnostics | Google Analytics 4, PostHog, Sentry | Analytics and session recording require consent; Sentry diagnostics operate separately |
| Form protection | Google reCAPTCHA v3 | Loads on interaction with public forms and immediately on administrator sign-in pages |
| Business operations | Google Workspace, Google Meet, Odoo, Aruba PEC | Email, meetings, client, proposal and invoice management, certified email |
| Business work-support tools | OpenAI, for ChatGPT Business and Codex | Business terms exclude training on the data; this does not authorise submission of a project's personal data |
Microsoft Teams meetings organised by clients, WhatsApp, Google Calendar for bookings and social platforms are not automatically Gitogi sub-processors. Their roles depend on the service, the organisation managing it and applicable terms. Gitogi also engages an external accountant and, depending on the project, external collaborators or partner companies: their roles must be determined by the activities they actually perform.
The developers of Claude Sonnet and Mistral Large do not become direct Gitogi AI providers merely because their models are available through Bedrock. Mistral AI SAS is not a direct provider to Gitogi: Mistral Large is used only through Bedrock.
The Claude Max plan is separate from the Website chat: it is governed by Anthropic's consumer terms, under which Anthropic acts as a controller, without a DPA. It must not receive clients' personal data and is not a sub-processor. Perplexity is used only for research using public sources, without personal data.
Locations and international transfers
An EU region identifies where a particular operation takes place or a dataset is stored. It does not, by itself, establish that the entire service chain remains within the EU.
Depending on the recipient and processing, transfers rely on adequacy decisions, the EU-U.S. Data Privacy Framework for covered recipients and transfers, or standard contractual clauses with supplementary measures where necessary. These mechanisms cannot be substituted without checking their requirements.
Odoo Cloud's Europe region includes production in France and Belgium and backups in France, the Netherlands and Sweden. Versions before 19 may retain an additional Canadian backup until the transition is complete. This regional description does not, by itself, identify Gitogi's database configuration.
For OpenAI business services, the contracting entity, locations and safeguards depend on the contract and service configuration. The register does not establish undocumented contractual options.
Verified information on the main providers is set out below:
| Service and entity | Documented locations and safeguards |
|---|---|
| Vercel — Vercel Inc. | Server functions in Frankfurt; DPA incorporating standard contractual clauses, Modules 1–3, as applicable to the relationship |
| Supabase — Supabase Pte. Ltd, Singapore | Database and authentication in Frankfurt; standard contractual clauses, Module 2 |
| Resend — Plus Five Five, Inc., United States | Main processing in the United States, sending region in Ireland; EU-U.S. Data Privacy Framework and standard contractual clauses, within their respective scope |
| Upstash — Upstash, Inc., United States | Database in London; EU adequacy decision for the United Kingdom in force; Data Privacy Framework for covered transfers to the United States and standard contractual clauses where the Framework does not cover the transfer |
| PostHog — PostHog, Inc. | EU Cloud; Data Privacy Framework and standard contractual clauses, within their respective scope |
| Sentry — Functional Software, Inc. | EU data region; Data Privacy Framework and standard contractual clauses, within their respective scope |
| Bedrock — Amazon Web Services EMEA SARL | Models run in the EU; the service does not retain content or use it for training |
| Google Cloud and Google Workspace — Google Cloud Italy S.r.l. for billing in Italy | Google's business tools (email, calendar, storage); relevant locations and safeguards must be identified in the applicable contracts and configurations |
| Google Analytics 4 | The Google Ads Data Processing Terms apply; Google Ireland Limited is among the entities listed. The relevant entity and safeguards must be identified for the applicable relationship |
| Odoo — Odoo S.A., Belgium | Acts as a processor for Odoo Cloud; production and backups in the Europe region are described above, including any temporary copy in Canada during the transition |
| LinkedIn Page Insights — LinkedIn Ireland Unlimited Company | Joint controller within the scope of page statistics, under the joint controller addendum |
The contracting entity for ChatGPT Business and Codex, and missing contractual information for other services, remain to be verified. A European region does not establish that all access takes place from within the European Economic Area.
For information and copies of applicable safeguards, contact info@gitogi.com.
Providers on client projects
Projects may use client-owned or Gitogi-owned accounts and involve external collaborators or partner companies.
Account ownership does not determine the data protection role. A provider engaged directly by a client may be that client's processor. A party entrusted by Gitogi with processing on the client's behalf may be a sub-processor even when working on the client's infrastructure.
Before a sub-processor receives data, the following are required:
- the client's specific or general written authorisation;
- identification of the party, activities and data involved;
- data protection obligations meeting Article 28 GDPR;
- necessary safeguards for international transfers.
Providers listed for the Website or business operations are not automatically authorised for every project. The Data Processing Agreement, relevant schedules and client instructions govern each engagement.
Changes to sub-processors
Where general authorisation applies, Article 28(2) GDPR requires clients to be informed of intended additions or replacements and given an opportunity to object before the new sub-processor is engaged.
For relationships governed by the DPA, Article 7 requires written notice at least 15 days before access to data and allows objections within that period. The new party must not process data during the notice period or, if an objection is raised, until it is resolved. A shorter period requires the Client's prior specific written authorisation. Updating this page does not replace that notice or amount to authorisation.