Last Updated: August 1, 2023

To support the delivery of our Services, RiskOptics, Inc. (“RiskOptics”) (or one of its Affiliates listed below) uses services providers (each, a “Subprocessor”) that may store or process Customer Data which may contain personal data.

RiskOptics requires its subprocessors to satisfy equivalent obligations as those required from RiskOptics (as a Data Processor) as outlined in RiskOptics’ Data Processing Agreement (DPA), including but not limited to the requirements to:

• process personal data following data controller’s (i.e., Customer’s) documented instructions (as communicated in writing to the relevant subprocessor by RiskOptics);
• in connection with the subprocessing activities, use only personnel who are reliable and subject to a contractually binding obligation to observe data privacy and security, to the extent applicable, under applicable data protection laws;
• promptly inform RiskOptics about any security breach; and
• cooperate with RiskOptics to address requests from data controllers, data subjects, or data protection authorities, as applicable.

The following table describes the legal entities acting as a subprocessor for RiskOptics, the service that subprocessor relates to, the function that subprocessor performs on behalf of RiskOptics, the categories of personal data processed by that subprocessor on behalf of RiskOptics, the location of the processing, the adequacy mechanism utilized between that subprocessor and RiskOptics, and a link to the public DPA that subprocessor offers.

Third Party Risk Management is conducted annually on all subprocessors.

RiskOptics Subsidiaries

Depending on the geographic location of a Customer or their authorized users, and the nature of the Services provided, RiskOptics may also engage our subsidiary to deliver some or all of the Services to a Customer.