Sub-processors and Subcontractors

Loyalty Juggernaut, Inc ("LJI") uses certain sub-processors (including members of the LJI Group and third parties, as listed below), subcontractors and content delivery networks to assist it in providing the GRAVTY Services in the Master Subscription Agreement (“MSA”). Defined terms used herein shall have the same meaning as defined in the MSA.

What is a Sub-processor

A sub-processor is a third party data processor engaged by LJI, including entities from within the LJI Group, who has or potentially will have access to or process Service Data (which may contain Personal Data). LJI engages different types of sub-processors to perform various functions as explained in the tables below. LJI refers to third parties that do not have access to or process Service Data but who are otherwise used to provide the Services as "subcontractors" and not sub-processors.

Due Diligence

LJI undertakes to use a commercially reasonable selection process by which it evaluates the security, privacy and confidentiality practices of proposed sub-processors that will or may have access to or process Service Data.

Contractual Safeguards

LJI requires its sub-processors to satisfy equivalent obligations as those required from LJI (as a Data Processor) in LJI’s Data Processing Agreement including but not limited to the requirements to:

This policy does not give Customers any additional rights or remedies and should not be construed as a binding agreement. The information herein is only provided to illustrate LJI’s engagement process for sub-processors as well as to provide the actual list of third party sub-processors, subcontractors and content delivery networks used by LJI as of the date of this policy (which LJI may use in the delivery and support of its Services).

Process to Engage New Sub-processors:

For all Customers, LJI will provide notice via this policy of updates to the list of sub-processors that are utilized or which LJI proposes to utilize to deliver its Services. LJI undertakes to keep this list updated regularly to enable its Customers to stay informed of the scope of sub-processing associated with the GRAVTY Services. LJI Customers may subscribe to receive notifications of updates to this policy by clicking “Follow updates” at the top of this policy.

A Customer may object in writing to the processing of its Personal Data by a new sub-processor within thirty (30) days following the update of this policy and such objection shall describe Customer's legitimate reason(s) for objection. If Customer does not object during such time period the new sub-processor(s) shall be deemed accepted.

If a Customer objects to the use of a new sub-processor to the process provided under the DPA, LJI shall have the right to cure the objection through one of the following options (to be selected at LJI’s sole discretion):

(a) LJI will cease to use the new sub-processor with regard to Personal Data;

(b) LJI will take the corrective steps requested by Customer in its objection (which remove Customer’s objection) and proceed to use the sub-processor to process Personal Data; or

(c) LJI may cease to provide or Customer may agree not to use (temporarily or permanently) the particular aspect of a GRAVTY Service that would involve use of the sub-processor to process Personal Data.

The following is an up-to-date list (as of the date of this policy) of the names and locations of LJI sub-processors, subcontractors and content delivery networks (including members of the LJI Group and third parties):

Infrastructure Sub-processors – Service Data Storage and Processing

LJI owns or controls access to the infrastructure that LJI uses to host and process Service Data submitted to the Services, other than as set forth herein. Currently, the LJI production systems used for hosting Service Data for the Services are located in co-location facilities in the United States and Europe and in the infrastructure sub-processors listed below. Customer accounts are established in one of these regions based on where the Customer is located; the Customer’s Service Data subsequently remains in that region unless agreed between Customer and LJI, but may be shifted among data centers within a region to ensure performance and availability of the Services. The following table describes the countries and legal entities engaged by LJI in the storage of Service Data. LJI also uses additional services provided by these sub-processors to process Service Data as needed to provide the Services.

Entity Name Entity Type Entity Country
Amazon Web Services, Inc. Cloud Service Provider. United States.
Amazon Data Services Ireland Ltd. Cloud Service Provider. Ireland.
Google Inc. Cloud Service Provider. United States

Service Specific Sub-processors

LJI works with certain third parties to provide specific functionality within the Services. These providers are the Sub-processors set forth below. In order to provide the relevant functionality these Sub-processors access Service Data. Their use is limited to the indicated Services.

Entity Name Purpose Applicable Services Entity Country
Mailchimp, Inc. Mailchimp, Inc. (“Mailchimp”) is an email campaign service provider used within GRAVTY to send notification emails and dashboards to Agents and End-Users. The primary information Mailchimp has access to is the email addresses of recipients of the emails and the content of the emails themselves. The content of the emails may include the dashboards Customer has chosen to include in the email campaign. Member Email Communication. United States
Datadog, Inc. Datadog, Inc. (“Datadog”) is a third party logging platform that LJI uses for ingesting, parsing, querying and performing analytics on Service application and infrastructure logs (“Logs”). These Logs are then used for debugging, troubleshooting, auditing, reporting, and detecting and alerting on unexpected application behavior. Incidental to the purpose of the Log Processing, Service Data and Personal Data may be Processed by Datadog. Examples of the data that may be in the Logs includes: timestamp, token ID, email address, user agent, username, Account ID, User ID, name, IP address, application paths and parameters, Session IDs, provisioned infrastructure, Ticket and Help Center data, Agent data and other types of Service Data. All United States

LJI Group Sub-processors

The following entities are members of the LJI Group. Accordingly, they function as sub-processors to provide the Services.

Entity Name Country
Loyalty Juggernaut, Inc. United States
Loyalty Juggernaut India Private Ltd India

Subcontractors

As explained above, LJI may use certain “subcontractors” to assist in the operations necessary to provide the GRAVTY Services as described in the Master Subscription Agreement. The following is a list (as of the date of this policy) of the names and locations of material third-party subcontractors. Subcontractors do not have access to Service Data.

Content Delivery Networks

As explained above, GRAVTY’s Services may use content delivery networks (“CDNs”) to provide the Services, for security purposes, and to optimize content delivery. CDNs do not have access to Service Data but are commonly used systems of distributed services that deliver content based on the geographic location of the individual accessing the content and the origin of the content provider. Website content served to website visitors and domain name information may be stored with a CDN to expedite transmission, and information transmitted across a CDN may be accessed by that CDN to enable its functions. The following describes use of CDNs by GRAVTY’s Services.

CDN Provider Services Using CDN CDN Location Description of CDN Services
Amazon Web Services, Inc. GRAVTY Global Public website content served to website visitors may be stored with Amazon Web Services, Inc., and transmitted by Amazon Web Services, Inc., to website visitors, to expedite transmission.