What is a Sub-Processor

A Sub-Processor is a third-party data processor engaged by Puzzel, including entities from within the Puzzel Group, who has or potentially will have access to or process Customer Data (which may contain Personal Data). Puzzel engages different types of Sub-Processors to perform various functions as explained in the tables below. Puzzel refers to third-parties that do not have access to or process Customer Data but who are otherwise used to provide the Services as “Subcontractors” and not Sub-Processors.

Due Diligence

Puzzel undertakes to use a commercially reasonable selection process by which it evaluates the security, privacy and confidentiality practices of proposed Sub-Processors that will or may have access to or process Customer Data.

Contractual Safeguards

Puzzel requires its Sub-Processors to satisfy equivalent obligations as those required from Puzzel (as a Data Processor) as set forth in Puzzel’s Data Processing Agreement (“DPA”), including but not limited to the requirements to:

• Process Personal Data in accordance with data controllers (i.e. Customers) documented instructions (as communicated in writing to the relevant Sub-Processor by Puzzel);
• In connection with their sub-processing activities, use only personnel who are reliable and subject to a contractually binding obligation to observe data privacy and security, to the extent applicable, pursuant to applicable data protection laws;
• Provide regular training in security and data protection to personnel to whom they grant access to Personal Data;
• Implement and maintain appropriate technical and organizational measures (including measures consistent with those to which Puzzel is contractually committed to adhere to insofar as they are equally relevant to the Sub-Processor’s processing of Personal Data on Puzzel’s behalf) and provide an annual certification that evidences compliance with this obligation. In the absence of such certification Puzzel reserves the right to audit the Sub-Processor;
• Promptly inform Puzzel about any actual or potential security breach; and
• Cooperate with Puzzel in order to deal with requests from data controllers, data subjects or data protection authorities, as applicable.

This policy does not give Customers any additional rights or remedies and should not be construed as a binding agreement. The information herein is only provided to illustrate Puzzel’s engagement process for Sub-Processors as well as to provide the actual list of third-party Sub-Processors and Subcontractors used by Puzzel as of the date of this policy (which Puzzel may use in the delivery and support of its Services).

If you are a Puzzel Customer and wish to enter into our DPA, please speak to your key account manager or email us at privacy@puzzel.com.

Process to Engage New Sub-Processors

Puzzel will provide notice to customers of updates to the list of Sub-Processors that are utilized or which Puzzel proposes to utilize to deliver its Services. Puzzel undertakes to keep this list updated regularly to enable its Customers to stay informed of the scope of sub-processing associated with the Puzzel Services.

Pursuant to the DPA, a Customer may object in writing to the processing of its Personal Data by a new Sub-Processor within thirty (30) days following the update of this policy and such objection shall describe Customer’s legitimate reason(s) for objection. If the Customer does not object during such time period, the new Sub-Processor(s) shall be deemed accepted.

If a Customer objects to the use of a new Sub-Processor pursuant to the process provided under the DPA, Puzzel shall have the right to cure the objection through one of the following options (to be selected at Puzzel’s sole discretion):

• Puzzel will cease to use the new Sub-Processor with regard to Personal Data;
• Puzzel will take the corrective steps requested by Customer in its objection (which remove Customer’s objection) and proceed to use the Sub-Processor to process Personal Data; or
• Puzzel may cease to provide or Customer may agree not to use (temporarily or permanently) the particular aspect of a Puzzel Service that would involve use of the Sub-Processor to process Personal Data.

Termination rights, as applicable and agreed, are set forth exclusively in the DPA.

The following is an up-to-date list (as of the date of this policy) of the names and locations of Puzzel Sub-Processors and Subcontractors (including members of the Puzzel Group and third-parties):

Third-party Sub-Processors

Puzzel works with certain third-parties to provide specific functionality within the Services. These providers are the Sub-Processors set forth below. In order to provide the relevant functionality these Sub-Processors access Customer Data. The following table describes the legal entities engaged by Puzzel in the processing of Customer Data and their respective processing locations. Their use and access are limited to the applicable Services.

Currently, the systems used for hosting Customer Data for the Services are located in two separate co-location facilities in Norway and in the infrastructure of the Sub-Processors listed below.

Puzzel Group Sub-Processors

The following entities are members of the Puzzel Group. Accordingly, they function as Sub-Processors to provide the Services.