At Loyalty Juggernaut, Inc ("LJI"), we use certain sub-processors (including members of the LJI Group and third parties, as listed below), subcontractors, and content delivery networks to assist us in providing the LJI Services listed in the Master Subscription Agreement ("MSA"). Defined terms used shall have the same meaning as defined in the MSA.

What is a Sub-Processor

A sub-processor is a third-party data processor engaged by LJI, including entities from within the LJI Group, which has or will have access to our Service Data (which may contain Personal Data). LJI engages different sub-processors to perform various functions, as explained in the sections below.

Due Diligence

At LJI, we undertake a commercially reasonable selection process to evaluate the Security, Privacy, and Confidentiality practices of proposed sub-processors that will or may have access to or process the Service Data. Our evaluation process ensures that these sub-processors comply with LJI's obligations as a data processor, listed in the Data Processing Agreement before we begin using their services.

Contractual Safeguards

We ensure all our sub-processors comply with specific criteria before we onboard them, which include but are not limited to the following:

1. To process the Personal Data according to the data controller's (i.e., LJI User's) documented instructions (as communicated in writing to the relevant sub-processor by LJI).
2. To use only reliable personnel for their sub-processing activities and subject them to a contractually binding obligation to observe Data Privacy and Security, as defined in the applicable data protection laws.
3. To provide regular training in security and data protection to personnel to whom they grant access to Personal Data.
4. To implement and maintain technical and organizational measures and provide an annual certification that evidences compliance with this obligation. These measures must be consistent with LJI's contractual commitments, mainly where they apply to Personal Data's sub-processors processing on LJI's behalf.
5. To promptly inform LJI about any actual or potential security breach.
6. To cooperate with LJI to deal with requests from data controllers, data subjects, or data protection authorities.

This policy does not give the LJI Users any additional rights or remedies, and they cannot construe this as a binding agreement. The information only illustrates LJI's engagement process for sub-processors.

Process to Engage New Sub-Processors

For all the LJI Users, we will provide notice via this policy of updates to the list of sub-processors that we use or may use to deliver its Services. We undertake to update this list regularly to enable our Users to stay informed of sub-processing associated with LJI Services.

A User may object in writing to the processing of their Personal Data by a new sub-processor within 30 days following the update of this policy. Such an objection shall describe the User's legitimate reason(s) for objection. If the User does not object during such time, we shall deem the new sub-processor(s) accepted. Suppose a User objects to using a new sub-processor to the process provided under the DPA (Data Processing Addendum), LJI may cure the objection through one of the following options (selected at our sole discretion):

1. LJI may cease to use the new sub-processor concerning Personal Data.
2. We may take the LJI User's corrective steps in their objection (which will remove the User's objection) and use the sub-processor to process Personal Data.
3. LJI may cease to provide, or LJI Users may agree not to use (temporarily or permanently) the particular aspect of a GRAVTY® Service that would involve using the sub-processor to process Personal Data.

Infrastructure Sub-Processors, Service Data Storage and Processing

LJI owns or controls access to the infrastructure that LJI uses to host and process Service Data submitted to the Services. Our production systems for hosting Service Data for the Services are currently in co-location facilities in the United States, Europe, India and Singapore. We establish Client accounts in one of these regions based on the LJI User's location; the Client's Service Data subsequently remains in that region unless agreed between Client and LJI, but we may shift it among data centers within an area to ensure performance and availability of the Services.

Service Specific Sub-Processors

LJI works with certain third parties to provide specific functionality within the Services that are set forth below. To provide the relevant functionality, these Sub-processors have access to the Service Data. Their use is limited to the below Services.

LJI Group Sub-Processors

The following entities are members of the LJI Group. Accordingly, they function as sub-processors to provide the Services.

Sub-Contractors

LJI refers to third parties that do not have access to or process Service Data but are otherwise used to provide the Services as subcontractors. LJI may use them to assist in the operations necessary to provide LJI Services as described in the Master Subscription Agreement. Subcontractors do not have access to Service Data.