List of sub-processors

Draft, not in force. Version 0.1 of 6 October 2026.

This list takes effect on {{EFFECTIVE_DATE}}.

This list is Annex IV of the data processing agreement. In this list "Socializza" means ITALDRONI S.r.l., which provides the Socializza service.

Subject matter

This list sets out the sub-processors that ITALDRONI S.r.l., with its registered office in Via Camillo Benso Conte di Cavour 13, 10019 Strambino (TO), Italy, engages as processor for Socializza.

The data processing agreement adopts Clause 7.7, Option 2, of the standard contractual clauses of Implementing Decision (EU) 2021/915. Under that clause the customer gives a general written authorisation, which refers to this list (section 7.1 of the data processing agreement).

The list is published at the stable address https://app.socializza.com/legal/sub-processors. For each sub-processor it states the name, registered office, function, categories of data, place of processing and transfer mechanism. The customer thus has the identity of every sub-processor available at all times, as EDPB Opinion 22/2024 requires.

Sub-processors

Amazon Web Services EMEA SARL is part of a group headquartered in the United States. For this reason the list states its transfer mechanism, even though the data stays in a region of the Union.

Who is not a sub-processor

The following entities do not process personal data on behalf of the customer, or process it in a different role.

• Cloudflare manages only the DNS of socializza.com. No customer data passes through Cloudflare.
• Tailscale manages the private network of Socializza's servers. Its control plane exchanges server keys and metadata, never customer data.
• GitHub and Codemagic host the source code and produce the builds. They receive no customer data.
• Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM) deliver notifications to the mobile app. Each notification carries only an opaque identifier, and the app downloads the content from the servers in the Union. Socializza processes the notification data as controller, outside the data processing agreement, and the privacy notice names these services.
• Stripe, Apple and Google process payment data, which Socializza processes as controller and not on behalf of the customer. The privacy notice and the data residency statement name them.
• Social platforms receive data because the customer chooses to publish on them. They are recipients chosen by the customer, set out in Annex II of the data processing agreement.

Changes to the list

The binding text is in sections 4.5 and 7 of the data processing agreement. In summary, the rules are these.

• Socializza notifies every addition or replacement of a sub-processor with 30 days' notice. The notice goes by email to the contact the customer named for the data processing agreement and appears as a banner in the app.
• Within the notice period the customer may object in writing, on grounds relating to the protection of personal data. Socializza first tries to accommodate the objection, for example by processing that customer's data elsewhere. If it cannot, the customer may terminate the affected service without penalty and receives a pro rata refund.
• If a sub-processor discontinues its service or a security issue requires immediate replacement, the notice may be shorter. The customer may object within 30 days of the notice, on the same terms.
• Every contract with a sub-processor imposes the same data protection obligations as the data processing agreement, as Article 28(4) of Regulation (EU) 2016/679 requires. Socializza remains fully liable to the customer for the performance of its sub-processors' obligations.

Every version of the list stays in the change log below. The log proves the date of every notice.

Change log