Legal
Sub-processors
Draft — to be reviewed by a lawyer before publication. Fields in square brackets (e.g. [FORNITORE HOSTING]) are to be completed. Version: draft 0.1 — last updated: [DATA]. In case of discrepancy the Italian version prevails.
This list shows the providers to which [RAGIONE SOCIALE] entrusts processing of personal data on behalf of the customers of the Prynt service, as provided by the Data Processing Agreement (article 6 and Annex 3). The same providers also process data for which Prynt is controller (see the privacy policy).
1. Sub-processors in use
| Provider | Service | Data processed | Data location | Transfer safeguards |
|---|---|---|---|---|
| [FORNITORE HOSTING] — [SEDE DEL FORNITORE] | virtual private server hosting the website, application, API, database and files | all service data | European Union — [PAESE DATA CENTER] | not applicable (no transfer outside the EEA) |
| [FORNITORE EMAIL] — [SEDE DEL FORNITORE] | delivery of service emails (SMTP or API) | recipient's email address and name, message content (verification links, invitations, notices, replies to requests) | [PAESE] | [to be stated if outside the EEA] |
| [FORNITORE BACKUP] — [SEDE DEL FORNITORE] | off-site storage of backups | all service data, encrypted before upload: the provider does not hold the key to decrypt it | European Union — [PAESE] | not applicable |
2. Providers used only if activated
They are not in use at the date of this list. Before activation the list will be updated and customers notified as provided by the DPA.
| Provider | When | Data processed | Notes |
|---|---|---|---|
| Stripe Payments Europe, Ltd. (Ireland) | only if Prynt activates self-service subscriptions paid online | billing and payment data of the customer organization | licensed customers are never involved |
| [INTERMEDIARIO SDI] | when automatic issuing of Italian e-invoices is activated | customer billing data | |
| Cloudflare, Inc. (global network) | only if website and application traffic is routed through Cloudflare's proxy (DDoS protection, WAF) | IP addresses and HTTP traffic in transit | transfers covered by the EU-U.S. Data Privacy Framework and standard contractual clauses; today Cloudflare, if used, only provides DNS and does not receive the traffic |
3. Providers that are not sub-processors
For transparency we also list services that do not receive customers' personal data:
- DB-IP ("IP to Country Lite" database): the database is downloaded and used on our own server; no IP address is sent to DB-IP.
- Let's Encrypt: issues the TLS certificates of our domains; it receives no user data.
- Uptime monitoring services (if used): check from outside that public pages and status endpoints respond; they do not access service data. Internal alerts contain only technical information (services, check results), not customer data.
- OpenAI (AI assistant of the Designer): used only if a user enables the assistant with their own OpenAI API key. Requests, the structure of the template, the names of tables and columns and, only if the user allows it, a few sample rows are sent to OpenAI under the customer's own account and contract, on the customer's instruction (DPA, article 3.4): OpenAI is not our sub-processor and Prynt does not store the content of requests.
- Prynt Gateway and Prynt Desktop: software installed by the customer on its own systems and under its control.
4. Changes
We announce the addition or replacement of a sub-processor at least [30] days in advance by email to the organizations' owners and by updating this page. To receive notices at a different address or for questions write to [EMAIL PRIVACY].
Questions about these documents? Contact Prynt.