Sub-processor Policy

1. The Basics.

1. SurveySparrow Inc., and its affiliates/subsidiaries (collectively “SurveySparrow”, “we”, “us” and “ours”) use certain subcontractors or third-parties (together the “Sub-Processors”) to assist in providing SurveySparrow services. 

2. What is a sub-processor

1. “Sub-processor” or “Sub-data Processor” means the service providers who interact with the Controller’s Data (in part or full) so as to offer the services promised by the Data Processor as per the Services Agreement.
2. SurveySparrow engages different types of Sub-Processors to perform various functions. In some cases, customer data includes personal data as defined by the General Data Protection Regulation (“GDPR”).

3. Due Diligence

1. SurveySparrow undertakes to use a commercially reasonable selection process by which it evaluates the security, privacy and confidentiality practices of proposed Sub-Processors that may be processing customer data.
2. As a minimum, we ensure that SurveySparrow’s Sub-Processors store and process all customer data we share with them in a manner that is compliant with EU data protection requirements under GDPR.

4. Contractual Safeguards

1. SurveySparrow requires the Sub-Processor’s to process personal data in accordance with data controller’s (i.e. customer’s) documented instructions.
2. In connection with their sub-processing activities, use only personnel who are reliable and subject to a contractually binding obligation to observe data privacy and security, to the extent applicable, pursuant to applicable data protection laws;
3. Provide regular training in security and data protection to personnel to whom they grant access to Personal Data;
4. Implement and maintain appropriate technical and organizational measures and provide an annual certification that evidences compliance with this obligation. In the absence of such certification SurveySparrow reserves the right to audit the sub-processor;
5. Promptly inform SurveySparrow about any actual or potential security breach; and
6. Cooperate with SurveySparrow in order to deal with requests from data controllers, data subjects or data protection authorities, as applicable.

5. Process to engage new Sub-Processors

1. For all customers who have executed SurveySparrow’s standard Data Processing Agreement (“DPA”), we will provide notice of updates to the list of sub-processors that are utilized or which we propose to utilize to deliver our services. We undertake to keep this list updated regularly to enable our customers to stay informed of the scope of sub-processing associated with the services.
2. Pursuant to the DPA, a customer may object in writing to the processing of its personal information by a new sub-processor within ten (10) days following the update of this policy and such objection shall describe customer’s legitimate reason(s) for objection. If the customer does not object during such a time period, the new sub-processor(s) shall be deemed accepted.

6. Sub-processors having access to customer data.

7. Updates

1. SurveySparrow will keep this list updated by adding the names of new or replaced sub-processors.
2. If you have any questions or concerns regarding our Sub-processors, please send us a detailed message to privacy@surveysparrow.com, and we will try to resolve your concerns.