Hosting and Subprocessor Schedule

This Schedule is incorporated into the Agreement by reference, forms part of and is governed by the Agreement, and has the same contractual effect as if set out in full within it. Where the Agreement or the Data Processing Addendum refers to the Subprocessors engaged by the Service Provider, that reference is to this Schedule as in force at the relevant time. In the event of any inconsistency, the Agreement (including the Data Processing Addendum) prevails, save that this Schedule governs the identification of Hosting Regions, infrastructure providers, Subprocessors and the transfer mechanisms relied upon. This Schedule creates no separate or additional remedy, and all liability arising under or in connection with it is subject to, and counts towards, the limitations and exclusions in Section 12 (Limitation of Liability) of the Agreement.

This Schedule is updated in accordance with the Subprocessor provisions of the Data Processing Addendum forming part of the Agreement (and, where applicable, the GDPR Supplemental Annex). The Service Provider gives at least thirty (30) days’ prior notice of any intended addition or replacement of a Subprocessor, and the Licensee may object on reasonable data protection grounds within thirty (30) days, as provided in those provisions.

Each version of this Schedule carries a version number and effective date. The version history in Section 8 records what changed and when.

The Licensee selects a Hosting Region in the applicable Quote, unless the Agreement specifies the Hosting Region, in which case that Hosting Region applies. Licensee Data is stored and Processed in the applicable Hosting Region only. A Hosting Region cannot be changed after the account is created.

The managed database service used in the Germany Hosting Region is OVHcloud Managed MongoDB, operated by OVHcloud. MongoDB, Inc. does not have access to Licensee Data and is not a Subprocessor in respect of that service.

3.1 Germany Hosting Region

3.2 United States Hosting Region

Subprocessor Standard Contractual Clause references:

• Amazon Web Services: https://d1.awsstatic.com/legal/aws-dpa/processor-to-processor-sccs.pdf
• MongoDB: https://www.mongodb.com/legal/dpa

The infrastructure providers named in Section 2 engage their own subprocessors in delivering their services. Each provider maintains its own subprocessor list and remains responsible for those subprocessors under its agreement with the Service Provider.

Changes made by an infrastructure provider to its own subprocessors are governed by the agreement between the Service Provider and that provider. Where such a change affects the Hosting Region selected by the Licensee, the Service Provider notifies the Licensee in accordance with the Subprocessor provisions of the Data Processing Addendum.

The following Subprocessors are engaged in the administrative and commercial relationship with the Licensee and apply across all Hosting Regions. They do not have access to Licensee Data.

This section is pending confirmation of the complete Account Data processor set.

Payment processing applies only where the Licensee pays by card. Where the Licensee pays by invoice and bank transfer, no payment Subprocessor Processes Account Data on the Service Provider’s behalf.

Where the Licensee has selected the Germany Hosting Region, access to Licensee Data is restricted to authorised personnel of the Service Provider and its Subprocessors located within the European Economic Area, the United Kingdom or Switzerland.

The Service Provider maintains technical and organisational controls to enforce this restriction, including named individual accounts, prohibition of shared or generic credentials, logging of all administrative access, and restriction of production environment access to personnel in the locations stated above. These controls are enforced by system configuration rather than by policy alone.

Where the Licensee has selected the United States Hosting Region, Licensee Data is Processed in the United States and the transfer mechanisms identified in Section 3.2 apply.

Account Data is Processed in the Service Provider’s business systems, which may be located outside the European Economic Area, in all Hosting Regions. The Subprocessors concerned are identified in Section 5 with the transfer mechanism relied upon.

Kendis Oy holds ISO/IEC 27001 certification. The current certificate, is available on request as provided in DPA Section 10 (Audit and Compliance).

Certifications held by the infrastructure providers named in Section 2 are published by those providers and are available on request as provided in DPA Section 10 (Audit and Compliance).