Subcontractor List

Last Updated January 13, 2025

Panaya uses the third-party vendors, subcontractors, sub-processors or other members, affiliates, of Panaya, all as listed below (each “Subcontractor”) to conduct and preform its business operations and services.

Certain Subcontractors carry out data-processing activities that involve access to customer personal data (“Customer Data”), these Subcontractors are referred as “Sub-processors” under applicable data protection laws. The Sub-processors process the personal data on behalf of Panaya’s customers, in accordance with customers’ instructions as communicated by Panaya, and in accordance with the terms of a written contract between Panaya and the said sub-processor.

Panaya uses commercially reasonable selection process by which it evaluates the security, privacy and confidentiality practices of proposed Subcontractors that will or may have access to or otherwise process Customer Data.

Panaya requires its Subcontractors to maintain a written information security program, not less rigorous than Panaya Security Measure Policy, available at https://www.panaya.com/information-security-policy/. Further, in the event of a security breach, Panaya requires the Subcontractors to immediately inform Panaya, and cooperate with Panaya (and to the extent applicable, with Panaya’s customers) to mitigate the breach. These Subcontractor contracts also include audit rights toward Panaya, and to the extent applicable towards Panaya’s customers.

Panaya considers the locations in which the Subcontractors are established and where would the data be hosted, processed, accesses and transferred when onboarding a new Subcontractor. Panaya required any Subcontractor to notify Panaya in case the location has changed.

This list is updated from time to time, including the names and locations of the Subcontractors, Panaya’s customers shall register below to the Subcontractor change notification to receive updates when Panaya makes changes to the list below.

The following table describes the countries and legal entities engaged by Panaya in the provision of Services.

Duration: For each Sub-processor, processing of personal data will be for the duration that the customer uses and continues to use the Service(s), and for the retention periods as set out in customer’s data processing agreement. Otherwise, for Subcontractors, Panaya reserves the right to replace, amend and terminate any relationship and will request data deletion upon termination.