Annex to the DPA § 6
Language versions. This document is drafted in Italian and is also published in English. The English version is a translation provided for convenience only: in the event of any conflict or doubt as to its interpretation, the Italian version shall prevail.
This page is the official source of the list. The customer, who is the controller, gives general authorisation for the use of sub-processors (DPA § 6.1); every addition or replacement is notified to customers with at least 30 days' notice, with a right to object on reasoned grounds under § 6.3 of the DPA. A copy of the Article 28 agreements concluded with each sub-processor, as far as they concern data protection, is provided to any customer who asks for it. Contact: doconure@limepeak.it.
The list has two parts, because there are two roles (see the Privacy Notice):
- Sub-processors of customer data (the data of signers and of documents, which we process as processor on the customer's behalf);
- Other recipients of data for which we are the controller (accounts, payments, the site), including the measurement tools that are switched on only with the consent of whoever visits the site.
1. Sub-processors of customer data
| Sub-processor | Service | Data processed | Location | Outside the EEA |
|---|---|---|---|---|
| OVH SAS / OVHcloud — Roubaix, France | computing infrastructure and object storage | all the data of the Service, as host | servers in Warsaw (PL), encrypted backup copies in Gravelines (FR) | no |
| Brevo SAS — Paris, France | sending transactional email and SMS (the only provider for both) | email address, mobile number, subject and full text of the messages — and therefore also signing links and one-time codes | EU | no |
| Openapi S.p.A. Unipersonale — Viale Filippo Tommaso Marinetti 221, 00143 Rome — VAT IT12485671007 · REA 1378273 · share capital EUR 50,000 fully paid | intermediary for the qualified electronic seal and the qualified timestamp (only if the customer asks for them) | for the seal: the whole document (it is sent to Openapi to be sealed); for the timestamp: the document's fingerprint, as part of the seal | data on Google Cloud, region europe-west1 (Belgium) | yes, limited: one of its sub-processors is in the United Kingdom (see below) |
| Namirial S.p.A. — Via Caduti sul Lavoro 4, 60019 Senigallia (AN) — VAT IT02046570426 · REA AN-157295 | qualified trust service provider behind Openapi: issues the seal's qualified certificate and the timestamp | what is needed to issue the seal and the timestamp; an independent controller for the data of its own customers | servers in the EU | no |
What the seal providers receive. The whole document goes to Openapi only when the customer (or the organisation's configuration) asks for the qualified seal: without that request no document leaves the Service towards them. The seal is a seal of the Provider, not a signature of the signer: it does not change the level of the signature, which remains simple.
The agreements. Openapi's processing is governed by its Article 28 GDPR agreement ("GDPR, Data Retention Policy & DPA", version 4.0 of 30 September 2026): the customer is the controller, Openapi the processor (for some services, under its own licence, also an independent controller); the data is encrypted at rest (AES-256) and in transit (TLS 1.2); Openapi notifies us of a breach within 48 hours; at the end of the relationship it deletes or returns the data within 30 days; it gives us 15 days' notice of each new sub-processor of its own, with a right to object. For the sub-processors of Openapi and of Namirial (and not for ours) the notice to customers is therefore the one the provider grants us, not less than 15 days: we pass it on the same day we receive it (DPA § 6.3). Namirial processes the data of its own customers as controller under its own notice (Mod.NAM GDPR03, rev. 08/10.2026; DPO: dpo@namirial.com); the data is processed on servers in the EU. Because the seal is bought through an intermediary (Openapi) and not directly from the provider (Namirial), there are two entries, with two agreements.
Openapi's sub-processors. In its agreement Openapi declares the following sub-processors: Innolva S.p.A., Younique Business S.r.l., 1-Reputo S.r.l., Smart Business Solution S.r.l., Sevendata S.p.A., Infocert S.p.A., Namirial S.p.A., Aruba S.p.A., Yousign S.r.l., Mcloud Ltd (United Kingdom) and Google Ireland Ltd. It is the general list of Openapi's services: not all of them take part in the seal service. The only one established outside the European Economic Area is Mcloud Ltd: the transfer is based on the European Commission's adequacy decision for the United Kingdom (Article 45 GDPR), in force at the date of this version (renewed in December 2025, expiring on 27 December 2031). Google Ireland Ltd belongs to a group whose parent is outside the EU; the data stays in the European region stated above.
When. The qualified seal and timestamp are offered from version 1.3 of the Service. For customers who already have an account, the first activation takes place no earlier than 30 days after the publication of this version of the list (DPA § 6.3): in the meantime they may object.
2. Other recipients of data for which we are the controller
| Recipient | Service | Data | Location | Outside the EEA |
|---|---|---|---|---|
| Revolut, payment provider | collecting payments for credits and subscriptions, and for renewals | name and billing details, amount and outcome of the payment. Card details do not pass through the Service: they are typed into the provider's page or form. We keep only the reference (token) of the customer and of the payment method, the expiry (month and year) and the last four digits | EU | no |
| European Commission — VIES service | checking the VAT number | a business's VAT number | EU | no |
| Italian Revenue Agency (SdI); tax adviser and provider of the accounting and e-invoicing software | invoices, VAT registers, tax filings | billing data and orders | Italy | no |
Payment is connected to Revolut; online purchases are open to customers from when registration opens after release 1.3, and until then no amount is charged.
Measurement and advertising tools: only with consent
On the public site (not on the signing pages, in the app, in the console or in the administration area) the following tools may be switched on, only for those who have given consent from the banner or from the "Manage cookies" link. Until consent no request is sent to these parties. Cookies, durations and purposes are in the cookie policy.
| Recipient | Tool | Purpose | Location and safeguards |
|---|---|---|---|
| Google Ireland Ltd | Google Analytics 4; Google Ads (conversions); Consent Mode v2 | measuring visits and campaigns; measuring advertising conversions | Ireland; transfers to the United States on the basis of the EU-US Data Privacy Framework |
| OpenAI Ireland Ltd | measurement pixel and conversions interface of OpenAI Ads | measuring the conversions of campaigns on ChatGPT | Ireland; safeguards stated by the provider |
| LinkedIn Ireland Unlimited Company | Insight Tag and conversions interface | measuring the conversions of LinkedIn campaigns | Ireland; safeguards stated by the provider |
| Meta Platforms Ireland Ltd | Meta pixel (no event from our server) | measuring the conversions of campaigns on Facebook and Instagram | Ireland; safeguards stated by the provider |
The conversion events we send from our server (to Google Analytics, OpenAI and LinkedIn; none to Meta) and the conversions we upload to Google Ads with a file (CSV) concern only those who consented.
Why these and not others
The criterion of preferring providers with a European contracting entity guided the choice of the mail and hosting provider in 2026: providers whose contracting entity is American were excluded even when the servers are in Europe, to reduce exposure to the CLOUD Act. The reasoning is documented internally and is available on request. The exceptions are those declared above: a sub-processor of Openapi in the United Kingdom, one belonging to a group outside the EU, and the measurement tools, active only with consent.
One provider for email and SMS. When an SMS provider had to be chosen, the technically better alternative was set aside in favour of Brevo precisely so as not to add an entry to this table: one more sub-processor is one more agreement to negotiate and maintain, and one more row to show every customer for the whole life of the product.
Providers that are not sub-processors
Listed because the question comes up, and the answer is clearer written down than improvised.
| Provider | Why it is not one |
|---|---|
| Domain registrar and DNS provider | has no access to personal data processed on customers' behalf |
| TLS certification authority | issues certificates for the domain name; no personal data |
| Source code repository | holds code, not operational data |
How this page is updated
- The provider goes into this table first, then into production. Never the other way round.
- Notice to customers 30 days in advance, running from publication.
- An Article 28 agreement signed with the sub-processor before it processes any data.
- A check of its transfers outside the EEA and of the safeguards.
- A consistent update of the Privacy Notice, the cookie policy and the internal asset inventory.
A provider switched on without going through here is a breach of contract towards every customer, not an administrative oversight. It is the reason the list is published and versioned together with the Service and does not live in a spreadsheet.