Subprocessor List

Subprocessor List

Virtik USA, Inc. may engage third parties to process personal data on behalf of customers. This page lists the third parties that the Service is configured to use, what they do, what data they touch, and the condition on which each is used. It also lists separately the providers that a customer connects with its own account and the services whose use Virtik has not verified. Section 1.2 states what this version does not state.

This list is referenced by the Data Processing Addendum (LEG-010) and forms part of it. Customers are entitled to notice of changes and to object, as the DPA states. Capitalized terms not defined here have the meanings given in the Terms (LEG-001).

1. Current subprocessors

1.1 Subprocessors, infrastructure providers and the payment processor (Virtik-managed)

This Section lists the third parties that the Service is configured to use, with an account or credential that Virtik holds or configures, for a function of the Service that can involve Customer Data. Virtik-managed use means that Virtik holds or configures the account or credential and the vendor acts for Virtik for that function. This Section does not state that a listed vendor is in production use. The Category column states whether the vendor is an infrastructure provider, the payment processor or a subprocessor. For the purposes of the DPA, each entry in this Section is a Subprocessor to the extent that it processes Customer Personal Data on Virtik's behalf. The entries are derived from the Service's own code, and Virtik adds a Subprocessor to this list before it processes Customer Personal Data on Virtik's behalf, as Section 8 of the DPA provides; an entry in Section 1.3 states no role and is not a statement that the vendor is or is not a Subprocessor.

Website enquiries. The Resend and Google Workspace entries concern personal data that a visitor submits through the Website's own forms or sends to Virtik by email, for which Virtik is the controller (Privacy Policy, LEG-002, Section 3.4). They do not concern Customer Data held in the Service. As Section 1.2 states for every entry, this version states no processing location, transfer mechanism, date or agreement status for either.

The AI Features can run with a provider credential that Virtik manages or with a provider account that Customer's Organization connects itself. Where Virtik's provider credential is used, the provider is a Virtik Supplier as the Terms define that term. A request that uses an account that Customer's Organization connects itself is described in Section 1.4. This list does not state that Virtik holds a managed credential for any of the three AI providers, and Virtik does not control or represent the data retention or training practices of an AI provider whose account Customer's Organization connects itself.

1.2 What this version does not state

This version does not state, for any entry, the processing locations, the transfer mechanism, the date from which the entry applies, or whether a data processing agreement is executed with that vendor, and Virtik does not represent any of them. It does not state the email delivery service used for authentication messages. It does not state that any entry is in production use for a particular Customer. A reader should not take an entry's presence in the table as a statement of any of them.

1.3 Services whose use Virtik has not verified

The Service's code can send data to the services below when a feature is enabled by Customer, by an Administrator or by an approved Provider, or when Virtik configures an optional component. Virtik has not verified that each is used in production, in what role, or for which data categories, and this Section states no role for any entry: it does not state that an entry is a subprocessor, a controller or a service provider of any kind. Placement of an entry in this Section is not a statement that it is or is not a Virtik Supplier as the Terms define that term. This Section states no processing location, retention period, transfer mechanism or agreement status for any entry, for the reasons Section 1.2 gives. The Credential column states which account or credential the code uses.

Browser-side resources. The user's browser requests fonts, scripts, style sheets and map, weather and traffic data from third-party hosts, including Google Fonts, unpkg, jsDelivr, a TensorFlow content delivery host and public map, weather and traffic data sources. Those hosts receive the browser's IP address and user agent and are not listed individually. The website analytics script named in the Cookie Policy (LEG-003) receives website visitor data only. The Metricool entry in Section 1.1 concerns a different function, the publication of content that an Organization creates in the Service.

1.4 Providers and connectors that Customer supplies

Where Customer's Organization connects its own account or credential, the vendor acts for Customer under Customer's own agreement with it. Customer is responsible for that relationship as a Third-Party Service, and the vendor is not a Virtik Supplier, not a Virtik-managed subprocessor and not subject to the notice in Section 3. The Service carries the Organization's data to and from the vendor on Customer's instruction.

2. Affiliates

Virtik affiliates that process customer personal data must be listed here on the same terms as third parties. This version identifies no affiliate.

3. Change notice and objection

Virtik will give customers at least 30 days' prior notice before a new or replacement Material Subprocessor (as Section 8.1 of the DPA defines it) processes customer personal data. Notice is given by email to the customer's Administrator, or to the contact designated in the Order Form, and this list is updated by the date on which the change takes effect. A customer may object in writing within 15 days after the notice, on reasonable and legitimate data protection grounds. If the objection is not resolved within 30 days after Virtik receives it, and the customer gives notice of termination within 15 days after that 30-day period ends, the customer may terminate the affected Service component (or the affected Order if it cannot be separated) before the new Material Subprocessor begins to process its personal data, without an early-termination charge and with a refund of the prepaid Fees for the period after termination, as Section 8 of the DPA and Section 16.6(g) of the Terms provide. That is the customer's only remedy for the objection. Virtik may give shorter notice to replace a subprocessor urgently to maintain the security or continuity of the Service, and will then give notice as soon as practicable. Virtik does not currently offer a subscription or automated notification service for these changes; notice is given by email as stated above, and the DPA and this page state the same period. This list applies to Customer in the version that is current under this Section 3 and Section 8 of the DPA, and a change that Section 8 of the DPA permits applies to Customer without a new acceptance, as Section 2.7 of the Terms and Section 8 of the DPA provide.

This Section applies to the entries in Section 1.1. It does not apply to a provider or connector that Customer supplies (Section 1.4), which the DPA excludes from Material Subprocessors. An entry in Section 1.3 carries no statement of role. If Virtik determines that an entry in Section 1.3 processes customer personal data on Virtik's behalf, Virtik will treat it as a new Subprocessor and will give the notice that Section 8 of the DPA requires before it does so.

4. What Virtik does not do

• Virtik does not sell personal information for monetary consideration.
• Virtik does not use Customer Data to train generalized or shared AI models offered to other customers without an express contractual authorization permitting that use, and does not control or represent the data retention or training practices of AI providers whose accounts customers connect themselves.
• Virtik does not currently hold SOC 2 attestation, ISO 27001 certification, HIPAA compliance certification, or FedRAMP authorization, and neither does listing a vendor here imply that Virtik has assessed that vendor against any such standard.

Language. This document is drafted in English. Translations are provided for convenience. In the event of a conflict, the English version controls, except where applicable law requires otherwise.

Version history

END OF DOCUMENT