Version 1.1 · Published on 19 October 2026
Jurisdiction and
governmental access to data
This page contains the information required by Article 28 of Regulation (EU) 2023/2854 (Data Act) and is referred to in the contracts of AtWorkStudio S.r.l. It is kept up to date; every version is retained by AtWorkStudio S.r.l. together with its publication date.
1. Jurisdiction of the infrastructure
The services of AtWorkStudio S.r.l. are delivered on one of the infrastructure types listed below. For each contract, the type used is stated in the service sheet, under “Delivery platform and provider jurisdiction”.
| Type | Data location | Jurisdiction of the infrastructure provider |
|---|---|---|
| Global public cloud | Data centres in European Union regions | Group headquartered in the United States: the provider is also subject to US jurisdiction |
| EU-qualified public cloud | Data centres in the European Union | Group headquartered in Italy: Italian jurisdiction |
| European cloud | Data centres in the European Union and Switzerland | Group headquartered in Switzerland: Swiss jurisdiction |
| Private cloud in Italy | Data centres in Italy | Group headquartered in Italy: Italian jurisdiction |
| Infrastructure at the Customer’s premises | Customer’s premises | No third-party infrastructure provider |
For the listed services the type is as follows:
| Service | Infrastructure type |
|---|---|
| ATWS Secure Workspace | Global public cloud |
| ATWS Email Security Gateway | EU-qualified public cloud |
| ATWS Secure Backup for Microsoft 365 | Global public cloud |
2. Measures against international governmental access
AtWorkStudio S.r.l. adopts the following measures to prevent international governmental access to non-personal data held in the European Union, or its transfer, where this would create a conflict with Union law or with the national law of the Member State concerned.
Organisational measures. Every request from an authority for access to, production or delivery of customer data is referred to the Management and subjected to an assessment of its legal basis before any access or delivery. For requests from authorities of a third country concerning non-personal data held in the European Union, the assessment verifies that the request is based on an international agreement in force between the third country and the Union or a Member State, such as a mutual legal assistance treaty, or, failing that, that the conditions of Article 32(3) of Regulation (EU) 2023/2854 are met; in the absence of these prerequisites the request is not acted upon. The customer concerned is informed of the request, unless the legal basis prohibits it. Access and delivery are limited to the data covered by the request. Every request and its outcome are recorded.
Contractual measures. The contracts of AtWorkStudio S.r.l. provide that customer information may be disclosed at the request of competent authorities only to the extent strictly necessary and after notifying the customer, where permitted.
Technical measures. Data is encrypted in transit and at rest. The customer may choose infrastructures whose provider is not subject to non-EU jurisdictions (EU-qualified public cloud, European cloud, private cloud in Italy, infrastructure at the Customer’s premises). Where the service provides for it, the customer may use their own encryption keys.
The list of subcontractors, with their location, is published at https://www.atworkstudio.it/en/subcontractors.
Version 1.1 · Published on 19 October 2026