Sub-responsabili
Ultimo aggiornamento: 2026-08-01
I seguenti sub-responsabili sono coinvolti da ObligoBoard nel trattamento dei dati personali per conto dei propri clienti, in conformità all'art. 28(2) GDPR e alla Sezione 6.4 del DPA.
Gli aggiornamenti sostanziali a questo elenco vengono notificati ai clienti con un DPA firmato con almeno 30 giorni di preavviso, come previsto dalla Sezione 6.4(b) del DPA.
| Sub-responsabile | Servizio | Regione (localizzazione dati) | Meccanismo di trasferimento |
|---|---|---|---|
| Vercel Inc. | Application hosting, CDN, edge runtime, blob storage | EU (Frankfurt) primary; global edge | EU SCCs (Module 3) for any US fallback; Vercel DPA in place |
| Neon Inc. | Managed PostgreSQL database hosting | EU (Frankfurt) | EU SCCs (Module 3); Neon DPA in place |
| Stripe Payments Europe Ltd. | Payment processing, subscription billing | EU (Ireland) primary; some routing to US via Stripe global infrastructure | Stripe DPA + EU SCCs (Module 3); Stripe is also an independent Controller for fraud-prevention purposes |
| Resend Inc. | Transactional email delivery | EU (Frankfurt) and US | EU SCCs (Module 3) for US-region processing; Resend DPA in place |
| Font Awesome (Fonticons, Inc.) | Icon CDN serving | Global edge (US-headquartered) | EU SCCs (Module 3); Font Awesome DPA available; minimal Personal Data — IP address and User-Agent only via CDN logs |
| Railway Corporation | Cookie-scanner execution (automated website cookie/tracker scanning) | EU (Amsterdam) | EU SCCs (Module 3) plus the UK Addendum, in place under the Railway DPA executed 2026-07-31; Railway Corporation is US-incorporated, so Chapter V applies notwithstanding EU-only processing in Amsterdam. A transfer impact assessment dated 2026-08-01 concluded essentially equivalent protection with low residual risk; available to customers on request. |
| Vercel Inc. | Evidence file & generated PDF document storage (Vercel Blob) | EU (Frankfurt) primary; global edge | EU SCCs (Module 3) for any US fallback; Vercel DPA in place |