Sub-processor Policy

1. The Basics.

1. Askfield Inc., and its affiliates/subsidiaries (collectively “Askfield”, “we”, “us” and “ours”) use certain subcontractors or third-parties (together the “Sub-Processors”) to assist in providing Askfield services. 

2. What is a sub-processor

1. “Sub-processor” or “Sub-data Processor” means the service providers who interact with the Controller’s Data (in part or full) so as to offer the services promised by the Data Processor as per the Services Agreement.
2. Askfield engages different types of Sub-Processors to perform various functions. In some cases, customer data includes personal data as defined by the General Data Protection Regulation (“GDPR”).

3. Due Diligence

1. Askfield undertakes to use a commercially reasonable selection process by which it evaluates the security, privacy and confidentiality practices of proposed Sub-Processors that may be processing customer data.
2. As a minimum, we ensure that SurveySparrow’s Sub-Processors store and process all customer data we share with them in a manner that is compliant with EU data protection requirements under GDPR.

4. Contractual Safeguards

1. Askfield requires the Sub-Processor’s to process personal data in accordance with data controller’s (i.e. customer’s) documented instructions.
2. In connection with their sub-processing activities, use only personnel who are reliable and subject to a contractually binding obligation to observe data privacy and security, to the extent applicable, pursuant to applicable data protection laws;
3. Provide regular training in security and data protection to personnel to whom they grant access to Personal Data;
4. Implement and maintain appropriate technical and organizational measures and provide an annual certification that evidences compliance with this obligation. In the absence of such certification Askfield reserves the right to audit the sub-processor;
5. Promptly inform Askfield about any actual or potential security breach; and
6. Cooperate with Askfield in order to deal with requests from data controllers, data subjects or data protection authorities, as applicable.

5. Process to engage new Sub-Processors

1. For all customers who have executed Askfield’s standard Data Processing Agreement (“DPA”), we will provide notice of updates to the list of sub-processors that are utilized or which we propose to utilize to deliver our services. We undertake to keep this list updated regularly to enable our customers to stay informed of the scope of sub-processing associated with the services.
2. Pursuant to the DPA, a customer may object in writing to the processing of its personal information by a new sub-processor within ten (10) days following the update of this policy and such objection shall describe customer’s legitimate reason(s) for objection. If the customer does not object during such a time period, the new sub-processor(s) shall be deemed accepted.

6. Sub-processors having access to customer data.