To support delivery of our Services, Data Zoo may engage and use third-party data processors (each a “Sub-processor”). Prior to engaging any third-party Sub-processor, we perform necessary due diligence to evaluate their security, privacy, and confidentiality practices, before entering into an agreement with each such Sub-processor to implement its applicable obligations.
Data Zoo uses certain Sub-processors (which may include entities in the Data Zoo group and other third parties, as listed below) to provide services relating to personal data that Customers as data controllers make available to Data Zoo through the Data Zoo Solution(s) (in Data Zoo contracts referred to as “End User Data”). Data Zoo appoint such Sub-processors only in accordance with applicable laws and regulations including, where EU/EEA/UK data subjects are concerned, the GDPR as applicable in the EU and the UK. Data Zoo will enter into written agreements with each Sub-processor including all required legal provisions, safeguards for international personal data transfers where required, as well as IT security standards similar to those set-out in Data Zoo’s Information Security Policy.
The following is an up-to-date list of the names, functional purpose, and locations of Data Zoo’s relevant Sub-processors currently engaged by Data Zoo to provide various services related to Data Zoo’s service offerings:
Sub-Processor | Permitted Activity/ Services Performed (Purpose/Function) | HQ Location / Entity Country/ Address | Service Delivery/ Processing Location(s) | External links for additional information relating to security |
|---|---|---|---|---|
Aha! | Ideas Management (Roadmaps/Ideas/Develop) | USA | USA Global | |
Atlassian (Jira, Confluence, Trello) | Technical Project Management Task Tracking Bug and Issue Tracking | Australia | Australia Ireland USA | |
Cloudflare | Cloud Hosting Provider and content delivery Website and application security Denial-of-service protection (DDOS) Load balancing and processing of traffic (inspection and blockage in case of malicious activity) between customer and Data Zoo services | United States of America | Global Cloud Hosting Provider and content delivery Website and application security Denial-of-service protection (DDOS) Load balancing and processing of traffic (inspection and blockage in case of malicious activity) between customer and Data Zoo services Cloudflare operates in 250 cities in 100+ countries around the world; the geographical area of our client will determine the most appropriate location through which data is transmitted. | Data Transit Privacy Whitepaper Note: Cloudflare is registered on the EU-US Data Privacy Framework |
CrushFTP | Secure File Transfers in the provision of IDV Services Including POC and Batch Processing | 297 Kingsbury Grade Ste 10, Stateline, Nv 89449 Nevada, United States of America | USA Global | |
Electronic Signature Platform to sign, send and manage contracts | San Francisco, United States of America | USA Global | ||
Employment Hero | HR Management; Payroll and Employee benefits | Level 2, 439-441 Kent Street, Sydney, NSW 2000, Australia | Australia | |
Functional Software, Inc. (dba Sentry.io) | Monitor logs and events. Error and Performance monitoring | 45 Fremont Street, 8th Floor San Francisco CA 94105 | USA | |
Google Cloud Platform | Cloud Infrastructure Services | 1600 Amphitheatre Parkway Mountain View CA 94043 | Sydney, Australia Singapore, Singapore Frankfurt, Germany | Note: Google and GCP is registered on the EU-US Data Privacy Framework |
HubSpot | Inbound marketing and sales support | 2 Canal Park, Cambridge, MA 02141, USA | Germany (primary AWS server), Dublin (secondary AWS server) | |
Intech Solution Pty Ltd | Address Cleansing Services | Level 7, 35 Spring St, Bondi Junction, NSW, 2022, Australia | Australia | |
Microsoft Office | Communication and collaboration, Storage, | United States of America | Australia | |
Postman | Monitoring and testing of Data Zoo API requests and responses, and testing of external data source APIs. | 201 Mission Street Suite 2375 San Francisco, CA 94105 | Australia New Zealand | |
Regula Baltija LLC | OCR Technology and Document Authentication Technology | 34 Visku St, Daugavpils, LV-5410, Latvia | Australia | |
Slack Technologies, Inc. | Internal Communication Tool | United States of America | USA | |
Vanta | GRC Compliance Tool- | United States of America | USA | |
Voyager | IT Infrastructure provider of our NZ Server to facilitate Batch and POC Services. | New Zealand | New Zealand | |
Xero | Accounting Software | Australia | Australia | |
Data Sources: All Data Sources utilised in the delivery of our Products and Services are listed and maintained at Data Zoo IDU® (https://idu-api.datazoo.com/) | The identity of our TPDP’s are protected trade secrets that are not included in this list. Balancing our need to protect our trade secrets with transparency and legal obligation, these TPDP’s may only be disclosed strictly upon request, where there is a clear, unambiguous legislative requirement. Where required, we will support end-users in satisfying their compliance obligations and in facilitating data subjects in exercising their legal rights (Privacy Request). | Each Data Source is categorised by and within a section corresponding to its geographical location. |
SUB-PROCESSOR CHANGES AND THE RIGHT TO OBJECT
As our business grows and evolves, the Sub-processors used to deliver our Service may change. We endeavour to provide the owner of the Customer’s account with notice of any new Sub-processors to the extent required under the Agreement and relevant Statutory and Regulatory requirements (including Data Protection laws and regulations) along with posting updates here.
As part of standard due diligence, we expect and require our Customers to familiarise themselves with our business and the list of Sub-processors provided above at the precontractual stage. At the time of contracting with Data Zoo, it is accepted that all Customers consent to the Sub-processors listed (current at that time). Where certain Sub-processors amount to protected Trade Secrets, the details may be disclosed subject to contractual and communication controls agreed between the parties.
Data Zoo may update the list of Sub-processors at any time by updating this page, as soon as practicable after the change or proposed change has been decided. We endeavour to give as much notice as is possible to allow our Customers the opportunity to exercise their right to object in so far as it applies to their particular contracting arrangement. Interested clients may sign up in order to receive notifications of changes to this list.
If as a current or prospective Data Zoo Customer you have a significant and legitimate objection to the use of any Sub-processor, you must promptly contact your regular Data Zoo contact to notify us of your objection in order to reach a speedy resolution.
Blacklisted or Excluded Sub-processors: Where appropriate, the Customer may take a proactive approach by providing Data Zoo with a list of Sub-processors that Data Zoo are instructed to exclude from use in the provision of services to that Customer (blacklisted or excluded sub-processors). It will be the Customers responsibility to ensure that the blacklist is maintained and promptly communicated to Data Zoo.
Urgent Basis: Sub-processors may be replaced on an urgent basis where such change is outside of Data Zoo’s reasonable control (e.g. if a Sub-processor ceases business or its agreement with Data Zoo is terminated early). Data Zoo will still follow the above process as soon as practicable after the change becomes known, however, data processing may be commenced by the Sub-processor on a temporary basis.
Resolution Options
Where a Customer objects to a change or provides an excluded or blacklist of sub-processors, Data Zoo may decide to remedy the objection through one of the following options:
Ensure the Customer’s personal data is not processed by the excluded or objected Sub-processor(s); or
Where possible, proceed to use the Sub-processor(s) but ensure changes are made to meet the Customer’s objections; or
Cancel or suspending all or part of the Data Zoo services that would involve the Sub-processor(s) processing that Customer’s personal data. If all or the primary part of Data Zoo’s services are cancelled, then subject to the terms and conditions of the agreement, the applicable Customer may be entitled to terminate the agreement for services and to a refund of any fees prepaid for any unused part of the term.