Subprocessor List
This page lists the third-party providers engaged by AITA World, S.L. ("AITA"), with registered office at Sabino Arana 8, 2º, 48013 Bilbao, Bizkaia, Spain, tax identification number (CIF) B75859744, that process personal data on our behalf as processors or subprocessors within the meaning of Article 28 of Regulation (EU) 2016/679 (GDPR).
Each provider listed below is engaged under a written data-processing agreement that imposes confidentiality, security, sub-engagement, assistance, and deletion obligations equivalent to those we owe as controller.
1. Hosting and Infrastructure
| Provider | Purpose | Processing Location | Transfer Safeguard |
|---|---|---|---|
| Amazon Web Services EMEA SARL / Amazon Web Services, Inc. | Primary backend infrastructure, application databases, and file storage for the AITA Platform | EEA — region eu-north-1 (Stockholm, Sweden) |
EEA (no transfer); SCC for any support access |
| Vercel Inc. | Hosting, deployment, and edge routing of the aita.world website |
USA / global edge network | EU–U.S. Data Privacy Framework + SCC |
| Cloudflare, Inc. | DNS, CDN, bot management, and denial-of-service protection | USA / global edge network | EU–U.S. Data Privacy Framework + SCC |
2. Analytics
| Provider | Purpose | Processing Location | Transfer Safeguard |
|---|---|---|---|
| Microsoft Corporation — Microsoft Clarity | Anonymous website usage analytics and session replay (sensitive inputs masked; 13-month retention). Loaded only after analytics consent. | USA | EU–U.S. Data Privacy Framework + SCC |
3. Marketing and Attribution
| Provider | Purpose | Processing Location | Transfer Safeguard |
|---|---|---|---|
| LinkedIn Ireland Unlimited Company / LinkedIn Corporation — LinkedIn Insight Tag | B2B campaign measurement and conversion attribution. Loaded only after marketing consent. | EEA / USA | EU–U.S. Data Privacy Framework + SCC |
| Google Ireland Limited / Google LLC — Google Ads | Conversion attribution for commercial enquiries. Loaded only after marketing consent. | EEA / USA | EU–U.S. Data Privacy Framework + SCC |
4. External Resources and Platform Integrations
| Provider | Purpose | Processing Location | Transfer Safeguard |
|---|---|---|---|
| Google Ireland Limited / Google LLC — Google Fonts | Delivery of brand webfonts. Loaded only after external-resources consent; otherwise fonts are served from our own server. | USA | EU–U.S. Data Privacy Framework + SCC |
| Google Ireland Limited / Google LLC — Google API Services | Gmail and Google Calendar synchronisation for Platform users who connect a Google account (see Privacy Policy §14). Applies only on app.aita.world. |
EEA / USA | EU–U.S. Data Privacy Framework + SCC |
5. Related Documents
- Our Privacy Policy describes the categories of recipients, the legal bases, and the retention periods that apply to each processing activity.
- Our Cookie Policy describes the categories of cookies and client-side technologies set by the providers listed above, and how to grant or withdraw consent.
- The Platform Privacy Notice describes processing on
app.aita.world.
6. Changes to This List
We update this page whenever a subprocessor is added, replaced, or removed, and we change the "Last updated" date accordingly. To be notified in advance of changes, or to raise an objection to a new subprocessor, write to privacy@aita.world.
7. Contact
AITA World, S.L.Sabino Arana 8, 2º, 48013 Bilbao, Bizkaia, Spain
Data Protection & Privacy: privacy@aita.world