Authorized Sub-processors
List of sub-processors used by TAGMOOD S.R.L. for the provision of the Webmaster360 services, with indication of service, purpose and primary location.
Last updated: July 21, 2026
This page lists the sub-processors and, for greater transparency, the external API providers that TAGMOOD S.R.L. may use in the provision of the Webmaster360 services.
The list forms an integral part of the Webmaster360 Data Processing Agreement.
See also Annex A — Description of Processing and Annex B — Technical and Organizational Measures.
How to Read the Locations
The configured region indicates the region selected by TAGMOOD for the primary storage or provision of the service.
This indication does not necessarily imply that every support, security, telemetry, technical management or vendor support activity takes place exclusively in the indicated region.
Where a provider may process data outside the European Economic Area, the transfer mechanisms provided for by the relevant Data Processing Agreement, the applicable contractual terms and the data protection legislation shall apply.
For a general overview of security measures, please refer to the Security Overview.
For API providers, Webmaster360 limits the data transmitted to the technical and geographic parameters necessary to obtain the requested service and does not provide for the sending of names, email addresses, credentials, editorial content or other direct identifiers, unless otherwise expressly configured at the Customer’s request.
Summary List
| Provider | Service | Primary Region or Location | Applicability |
|---|---|---|---|
| DigitalOcean, LLC | Application hosting and managed MySQL database | AMS3, Amsterdam, Netherlands |
Always |
| Amazon Web Services EMEA SARL | Multimedia content storage via Amazon S3 | eu-west-1, Ireland |
Always |
| Laravel Holdings Inc. | Laravel Forge for server management and deployment | Global service; US-based provider | Always |
| Laravel Holdings Inc. | Laravel Nightwatch for application monitoring, errors and logs | Global service; US-based provider | Always |
| Union Lab SRL | SimpleBackups and SimpleStorage for encrypted external backups | eu-north-1, European Union |
Always |
| Cloudflare, Inc. | DNS, reverse proxy, caching, Web Application Firewall and anti-bot protection | Global network, standard configuration | Always |
| OpenAI Ireland Limited | Processing of AI features via API | EEA and any further locations governed by the provider’s DPA | Only when AI features are used |
| OpenWeather Ltd | Weather data and forecasts via OpenWeatherMap API | United Kingdom and provider’s global infrastructure | Only when the weather service is active |
| Media10 di Giovanni Bellicini & C. S.A.S. | On-duty pharmacy search via FarmacieDiTurno.org API | Italy | Only when the on-duty pharmacy service is active |
DigitalOcean
Entity: DigitalOcean, LLC
Service: application infrastructure and managed MySQL database
Purpose: application hosting, database management, availability, managed backups and infrastructure operations
General categories of data: content, accounts, data held in databases, logs and technical data
Configured region: AMS3 — Amsterdam, Netherlands
Applicability: necessary for the ordinary provision of the service
International transfers: possible in accordance with the provider’s DPA, affiliates and sub-processors
Amazon Web Services
Entity: Amazon Web Services EMEA SARL
Service: Amazon Simple Storage Service (Amazon S3)
Purpose: storage of multimedia content
General categories of data: images, videos, documents, files and related metadata
Configured region: eu-west-1 — Ireland
Applicability: necessary when multimedia content is stored through the Webmaster360 infrastructure
International transfers: possible in accordance with the AWS DPA, affiliates and support services of the provider
Laravel Forge
Entity: Laravel Holdings Inc.
Service: Laravel Forge
Purpose: server management, technical configuration and application deployment
General categories of data: server configurations, deployment data, protected technical credentials and operational logs
Primary location: service managed by a US-based provider
Applicability: necessary for infrastructure management
International transfers: yes, in accordance with the provider’s DPA and transfer mechanisms
Laravel Nightwatch
Entity: Laravel Holdings Inc.
Service: Laravel Nightwatch
Purpose: performance monitoring, error analysis, technical tracing and application log management
General categories of data: errors, stack traces, metrics, application logs, HTTP request information, queries and contextual technical data
Primary location: service managed by a US-based provider
Applicability: necessary for monitoring, diagnosis and application security
International transfers: yes, in accordance with the provider’s DPA and transfer mechanisms
TAGMOOD configures the service with the aim of limiting collection to the data reasonably necessary for monitoring, error diagnosis, performance and security.
SimpleBackups
Entity: Union Lab SRL
Services: SimpleBackups and SimpleStorage
Purpose: creation, encryption and storage of external backup copies
General categories of data: encrypted copies of databases and archives necessary for restoration
Configured region: eu-north-1 — European Union
Applicability: necessary for the external backup system
International transfers: possible for management, support activities or use of further suppliers, in accordance with the relevant DPA
Cloudflare
Entity: Cloudflare, Inc.
Service: DNS, reverse proxy, caching, Web Application Firewall and anti-bot protection
Purpose: traffic routing, resource distribution, security and mitigation of automated or malicious traffic
General categories of data: IP addresses, HTTP headers, request information, security logs and resources temporarily stored in cache
Primary location: global network, standard configuration
Applicability: necessary for the protection and distribution of managed websites
International transfers: yes, in accordance with the Cloudflare DPA and related transfer mechanisms
TAGMOOD does not declare the activation of specific contractual European localization features for Cloudflare.
OpenAI
Entity: OpenAI Ireland Limited
Service: OpenAI API
Purpose: processing of artificial intelligence features activated by authorized users
General categories of data: prompts, selected texts or excerpts, contextual instructions, outputs and technical metadata
Primary location: EEA and any further locations governed by the provider’s DPA
Applicability: only when the Customer activates or uses the AI features
International transfers: possible on the basis of the mechanisms provided for by the provider’s DPA and Applicable Law
Under the terms applicable to the API, data sent is not used to train or improve models, unless explicit opt-in to data sharing is given. In the absence of specific configurations approved by the provider, certain data may be temporarily retained for security and abuse monitoring purposes.
OpenWeather
Entity: OpenWeather Ltd
Service: OpenWeatherMap API
Purpose: provision of weather data, current conditions and forecasts relating to the requested location
General categories of data: location, municipality name, postal code or geographic coordinates required for the request; API key identifier and aggregated service usage data
Primary location: United Kingdom and provider’s global infrastructure
Applicability: only when the Customer activates or uses the weather service
International transfers: possible in accordance with the privacy policy, contractual terms and the provider’s international organization
OpenWeather states in its privacy policy that it does not collect or store API request parameters, such as locations, postal codes, city names or coordinates, nor the IP address and user agent relating to API calls. The provider logs the API usage volume associated with the account.
FarmacieDiTurno.org
Entity: Media10 di Giovanni Bellicini & C. S.A.S.
Service: FarmacieDiTurno.org API
Purpose: search and display of open and on-duty pharmacies in the requested location
General categories of data: municipality, address, coordinates or other geographic parameters required for the search and technical metadata of the API call
Primary location: Italy
Applicability: only when the Customer activates or uses the on-duty pharmacy service
International transfers: not expected for the main service based on publicly available information; may depend on any technical suppliers used by the service
Webmaster360 uses the API to obtain information relating to open or on-duty pharmacies. The sending of names, email addresses, credentials, editorial content or other direct user identifiers is not provided for.
Information on opening hours and on-duty shifts may be subject to change. Its display must be accompanied by an indication to verify the data at the pharmacy or through the competent health sources.
Changes to the List
TAGMOOD shall communicate the intention to add or replace a sub-processor with at least 30 days’ notice:
- by updating this page; and
- by sending a communication to the administrative or privacy address associated with the Customer.
The Customer may lodge an objection within the notice period exclusively for documented and reasonable grounds relating to the protection of personal data.
The procedures for handling objections are governed by the Webmaster360 Data Processing Agreement (in particular by Article 9 — Sub-processors).
Contacts
For information on sub-processors or to submit a reasoned objection:
- Privacy: privacy@tagmood.it
- Operations and security: webmaster360@tagmood.it
- PEC: tagmood@pec.it