List of Sub-processors
Annex A to the Data Processing Agreement
Document version 1.2 — list effective from 31 August 2026
Itinovo S.r.l. engages the providers listed below in order to deliver the itinovo CRM service. Each of them is bound by contract to data protection obligations equivalent to those itinovo undertakes towards its customers.
Changes to this list are notified with at least 30 days' notice to the account administrator's email address, and this page always reflects the version in force. Within that period the Customer may object in accordance with Clause 8 of the Data Processing Agreement.
Active sub-processors
| Provider | Service performed | Data processed | Place of processing | |||
|---|---|---|---|---|---|---|
| Amazon Web Services EMEA SARL 38 Avenue John F. Kennedy, L-1855 Luxembourg |
Cloud infrastructure: database, document storage, compute, user authentication, execution of artificial intelligence models (Amazon Bedrock) | All data entered into the platform | European Union — eu-central-1 region, Frankfurt am Main (Germany). Artificial intelligence models are executed in AWS regions located within the European Union (see the note below) |
Delivery of email communications generated by the platform (quotations, travel documents, notifications) | Email addresses and content of the communications | European Union — eu-central-1 region, Frankfurt am Main (Germany) |
| Stripe Payments Europe, Limited and Stripe Technology Europe, Limited Dublin, Ireland |
Processing of payments made by the agency's end clients | Identification and contact data of the payer, amount and reference of the transaction. Payment card data neither transits through nor is stored on itinovo systems | Ireland, with possible intra-group transfers to the United States on the basis of the European Commission's Standard Contractual Clauses | |||
| Mapbox, Inc. Washington DC, United States |
Display of maps within the platform and in travel documents | IP address of the device displaying the map and the geographic coordinates requested. No identification or travel data | United States, on the basis of the European Commission's Standard Contractual Clauses | |||
| Unsplash, Inc. United States |
Search and display of the stock images used in the platform's galleries | IP address of the agency user's device when previews are displayed during the search. No data relating to end clients or participants | Outside the European Union, according to the provider's privacy policy. The transfer is limited to the IP address transmitted by the browser when requesting the preview | |||
| Openapi S.p.A. viale Filippo Tommaso Marinetti 221, 00143 Rome, Italy |
Transmission of electronic invoices to the Italian Exchange System and to the equivalent systems of other European countries, and receipt of the related notifications | Identifying and tax data of the agency's end client as shown on the invoice (name, address, VAT or tax code, recipient code), amounts and line descriptions | Italy (European Union) |
Notes
Artificial intelligence models. The platform's AI features use third-party models (including Anthropic and OpenAI) executed by Amazon Web Services through the Amazon Bedrock service. Execution takes place through an inference profile restricted to AWS regions within the European Union, with eu-central-1 (Frankfurt am Main) as the primary region: processing may therefore take place in a different European AWS region, but the data never leaves the territory of the Union. The model providers neither receive nor have access to the data processed, which does not leave the AWS infrastructure on European territory and is not used to train any model.
Stock images. The previews displayed during the search are loaded directly from the provider's network, which therefore receives the device's IP address. The images actually selected are downloaded onto itinovo systems and served from our own content delivery network: from the moment of selection onwards the browser no longer connects to the provider.
Services not included. itinovo uses third-party services that do not process customers' personal data and therefore do not appear in this list:
- Flight availability search services receive only search parameters (dates, airports, number of travellers) and no identifying data.
- Web traffic analytics tools are active exclusively on the public pages of the corporate website and of the platform, such as the sign-in pages and the legal texts, subject to the user's prior consent collected through a consent banner. They are not active within the authenticated area of the platform: the activity of agency users and the data contained therein are not subject to any third-party tracking.
Should any of these conditions change, the list will be updated with the notice period set out above.
Certifications of the infrastructure provider. Amazon Web Services is certified to ISO/IEC 27001, ISO/IEC 27017 and ISO/IEC 27018, holds SOC 1, SOC 2 and SOC 3 attestations and the BSI C5 compliance catalogue for the German market. The relevant documentation is available through AWS Artifact and can be provided on request.
Electronic invoicing. Electronic invoices are transmitted through a single provider, which interfaces with the national electronic invoicing systems of the countries in which Customers operate. The provider is involved only where the Customer uses the electronic invoicing feature, and processing remains in every case within the European Union.
List effective from 31 August 2026. For questions about this list: privacy@itinovo.com