PrivMX data subprocessors

Introduction

This document gives you an information about all possible third parties that process personal data as our processors, subprocessors or entities acting as a separate data controllers. Please, keep in mind that all data stored on a PrivMX Team Server, uploaded by PrivMX Client Software are end to end encrypted and both we and our subprocessors are not able to decrypt them.

According to our Privacy Policy, if:

• you are our Client or User of PrivMX Services,
• you visit one of our public web pages, Control Center page or our social media fanpage,

we may transfer your personal data to some of the data processors (companies that process data on our behalf) or other entities that may gain access to your data. In order to provide you with a comprehensive information about processing your personal data, we present you with a detailed list of these entities, specified below.

This document does not include possible state authorities that may demand access to financial data concerning our services (e.g. tax authorities).

Processing personal data stored within PrivMX Team Servers

If you, acting as a Client, conclude a Data Processing Agreement with us, we may transfer some of the data that you process via our services (especially if you store your data on PrivMX Team Servers) to other entities that help us with providing services for you (subprocessors). It is possible that you will be allowed to choose a location of a data center where your data will be stored. Please keep in mind that this data, uploaded via PrivMX Client Software are encrypted on your device, so we are not able to decrypt them.

Companies that may receive data that you process in connection with using our PrivMX Services:

• Amazon Web Services EMEA SARL with its registered office in Luxembourg,
• Microsoft Ireland Operations Limited with its registered office in Dublin, Ireland,
• Leaseweb Netherlands B.V. with its registered office in Amsterdam, the Netherlands,
• OVH BV with its registered office in Amsterdam, the Netherlands,
• OVH sp. z o.o. with its registered office in Wroclaw, Poland.

In case if you choose a data center outside the European Economic Area, your personal data may be transferred to another Amazon or Microsoft group company responsible for the specific data center. In this case, the legal basis for the transfer of such data outside the European Economic Area are the Standard Contractual Clauses, approved by the European Commission.

Please keep in mind that this concern the data that you store on a PrivMX Team Server or data processed in connection with communication with other persons via PrivMX Team Server (e.g. via PrivMX Meeting). You may process these data both as a data controller or as a data processor. It means that you may use PrivMX Services in order to process data that were provided to you by a separate data controller and you act as a data processor. We consider ourselves a data processor or further data subprocessor.

Processing personal data in order to perform provisions of Terms of Services

Some of our data processors will receive your data only to a limited extent. That especially concerns processing personal data via our Control Center (a place where you may manage your services, our public website or processing personal data in order to provide you with online services, according to the provisions of our Terms of Service, such as maintaining services or issuing invoices. We also use external services to measure traffic on our public website or to perform other marketing activities, such as advertising our services.

Therefore, these companies may gain access to your data:

• Amazon Web Services EMEA SARL with its registered office in Luxembourg,
• Microsoft Ireland Operations Limited with its registered office in Dublin, Ireland,
• TransIP B.V. with its registered office in Leiden, the Netherlands.

In case if you choose a data center outside the European Economic Area, your personal data may be transferred to another Amazon or Microsoft group company responsible for the specific data center. In this case, the legal basis for the transfer of such data outside the European Economic Area are the Standard Contractual Clauses, approved by the European Commission.

If you are our Client (you purchase PrivMX Services) your personal data will also be processed by Paddle.com Market Limited with its registered office in Corby, United Kingdon - a reseller company that is responsible for orders' processing, payments and taxes. They process your personal data as a separate data controller.

Other data recipients

We may also process your personal data together with other entities in order to conduct marketing and advertising activities. We may use social media platforms and process personal data of their users, as long as they interact with our fanpage or public websites. Therefore, we hereby inform you that we may process your personal data together with LinkedIn Corp., Twitter, Inc., as well as Facebook Ireland Ltd., with its registerd office in Dublin, Ireland.

Detailed list of subprocessors

If you look for detailed description of processing activities that may lead to providing your personal data to other entities, see the table with a list of our subprocessors or data controllers below.

rev 15032023