Elenco dei Sub-responsabili del Trattamento

GIORIZZ S.r.l. (“we”, “us”, “our”) engages the following sub-processors to assist in the delivery of our luxury chauffeur booking platform and related services. Each sub-processor has been assessed for compliance with applicable data protection requirements and is bound by a Data Processing Agreement (DPA) in accordance with GDPR Article 28.

This page is maintained as a living document. We will notify registered users and agency partners of any changes to this list at least 30 days before the new sub-processor begins processing personal data, as required by our Privacy Policy and Agency Terms.

Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place in compliance with GDPR Chapter V (Articles 44–49):

• EU Standard Contractual Clauses (SCCs) — Commission Implementing Decision (EU) 2021/914, used for transfers to the United States and other countries without an EU adequacy decision
• UK International Data Transfer Agreement (IDTA) — or UK Addendum to EU SCCs, as approved by the ICO, for transfers involving UK personal data
• Swiss Addendum — EU SCCs with Swiss-specific modifications recommended by the FDPIC, for transfers involving Swiss personal data
• ANPD Standard Contractual Clauses — in force since August 2025, for transfers involving personal data of Brazilian data subjects under the LGPD
• Adequacy Decisions — where the European Commission, UK Government, or other relevant authority has issued an adequacy decision for the destination country, transfers proceed without additional contractual safeguards

We regularly review the legal landscape and will update transfer mechanisms as required by supervisory authority guidance or court rulings.

In accordance with GDPR Article 28(2) and our contractual obligations, we follow this process when engaging a new sub-processor or making material changes to an existing sub-processor relationship:

Right to object: Agency partners under a Data Processing Agreement may object to the engagement of a new sub-processor within 30 days of notification. If no reasonable resolution can be reached, the agency partner may terminate the affected services in accordance with the Agency Terms.

For each sub-processor, GIORIZZ ensures:

• Written DPA imposing equivalent data protection obligations to those in our own processing agreements (GDPR Art 28(4))
• Due diligence on the sub-processor’s technical and organisational security measures before engagement
• Ongoing monitoring of sub-processor compliance through audit rights, certifications review, and incident response procedures
• Liability — GIORIZZ remains fully liable for the performance of its sub-processors (GDPR Art 28(4))
• Data minimisation — each sub-processor receives only the minimum personal data necessary for its designated processing purpose
• Incident response — sub-processors are contractually required to notify GIORIZZ of any personal data breach within 24 hours of discovery

In accordance with GDPR Article 28(3)(h), controllers and their authorised representatives have the right to audit GIORIZZ’s use of sub-processors. For agency partners, audit rights are governed by Section 9.2 of the Agency Terms.

Audit requests should be directed to:

• Email: info@giorizz.com
• Subject: Sub-processor Audit Request — [Organisation Name]

For questions about our sub-processors or to subscribe to change notifications:

Related documents:

• Privacy Policy — full details on data collection and processing
• Data Subject Access Request — exercise your privacy rights
• Agency Terms — including Data Processing Agreement provisions
• Cookie Policy — cookies and tracking technologies