Flarseo
Subprocessors
Running the platform relies on a handful of suppliers. Here are the categories, the purpose of each one, and the rule by which we notify you when something changes.
Courtesy translation. Only the Italian version of this document has legal value: if the two texts diverge, the Italian text prevails. Italian law applies to the relationship in any case.
Why this page exists
Article 28 of the GDPR lets a processor engage further processors, the subprocessors, only with the authorisation of the controller and provided the controller is informed of every change.
This page is how we meet that duty to inform, publicly and verifiably, rather than burying it in an annex nobody reads.
Summary of the data processing agreement
The categories we use
| Category | Purpose of processing | Location |
|---|---|---|
| Cloud hosting and infrastructure | Running the application, databases, storage of content and backups, delivery of pages. | European Union |
| Language model providers | Generating and reviewing articles, social posts, website copy and editorial analysis, at the customer request. | European Union or a third country with the safeguards of chapter V of the GDPR |
| Payment service | Card authorisation, collection of the monthly fee, refunds and receipts. Card data stays with the provider. | European Union or a third country with the safeguards of chapter V of the GDPR |
| Transactional email delivery | Delivery of the contract, credentials, system notifications and service messages. | European Union |
| SEO data providers | Measuring search rankings, search volumes, visibility data and competitor analysis. | European Union or a third country with the safeguards of chapter V of the GDPR |
| Error monitoring | Collecting technical faults in the application so defects can be diagnosed and fixed. | European Union |
The location shown is that of the service category, not of an individual supplier. The per supplier detail, with the safeguard applied to each, is in the annex to the DPA and is provided on request.
How to read the table
We describe suppliers by category and role, not by brand name. That is not evasiveness: it keeps this page accurate even when a supplier is replaced, without forcing you to reread it every month.
The named list exists, is current and is available: it is delivered as an annex to the DPA and can be requested at any time, including before you subscribe.
Every row describes processing that actually happens. We do not list "possible" categories just to cover ourselves.
How we choose a supplier
- They must accept a processing agreement compliant with article 28, with duties no less strict than the ones we owe our customers.
- They must document security measures appropriate to the type of data they handle.
- They must let us know where processing happens and, outside the European Economic Area, which chapter V safeguard applies.
- They must allow deletion of the data when the relationship ends.
- All else being equal, we prefer suppliers processing inside the European Union.
We remain fully liable to the customer for the performance of the subprocessors we choose.
Language models and your content
Generating content requires sending the language model providers the context needed: description of the business, tone of voice, services, materials you uploaded, instructions from the conversation.
We require terms from model providers that exclude the use of transmitted content for training their models. We do not use your content to train models, ours or anyone else.
Even so, please do not put into the platform data that must not leave your organisation: health data, data about minors, third party trade secrets, credentials.
Location and transfers
Where we can, we choose suppliers processing inside the European Economic Area. For some categories, in particular language models and certain SEO data, the European offering does not cover every need.
When processing happens outside the European Economic Area we apply a chapter V safeguard: an adequacy decision of the European Commission, or the standard contractual clauses with the supplementary measures required.
You can ask which safeguard applies to each supplier by writing to info@flarseo.com.
The named list
The current list with each supplier name, location, role and the safeguard applied to transfers is an annex to the DPA.
It is delivered together with the contract at signup, and can be requested at any time, including before subscribing, by writing to info@flarseo.com with your company name and VAT number.
We do not publish the named list on this page so as not to expose our supply chain to people with no relationship to us. Anyone with a legitimate interest gets it.
How we notify changes
- When we decide to add or replace a subprocessor, we update the list annexed to the DPA and the version of this page.
- We notify the change by email to active customers, with reasonable notice before the new supplier starts processing data.
- The notice states the category, the purpose, the location and the safeguard applied to transfers.
- If the change is forced by a technical or security emergency we still notify it, stating the reason for the urgency.
The right to object
The customer may object to a new subprocessor on documented and reasonable data protection grounds, within the deadline stated in the notice.
If an objection is raised we look for an alternative together, for instance a different supplier or a configuration that excludes that category of processing for the workspace concerned.
If no workable solution exists, the customer may withdraw as provided in the framework agreement, without penalty.
Questions and requests
For the named list, for a copy of the transfer safeguards or for a documentary review, write to info@flarseo.com with your company name and VAT number.
Formal requests may also be sent to the certified email collaborazionidigitali.srl@legalmail.it.
Need the list with the names?
We send it to anyone who asks, including before signing. Give us your company name and VAT number and you will receive it together with the DPA text.