Annex III to Standard Contractual Clauses — List of Sub Processors

Last Updated: 22 February 2023

• MODULE TWO: Transfer Controller to Processor
• MODULE THREE: Transfer Processor to Processor

This Annex must be completed for Modules Two and Three, in case of the specific authorisation of sub-processors (Clause 9(a), Option 1).

The controller has authorised the use of the following sub-processors:

1. Name: Microsoft Corporation

Address: One Microsoft Way, Redmond, Washington 98052-6399 USA

Contact person’s name, position and contact details: Microsoft Privacy Team; Privacy Team; https://www.microsoft.com/en-us/concern/privacy; and Main Phone: +1 (425) 882-8080

Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Hosting Provider

2. Name: Salesforce.com, Inc.

Address: 415 Mission Street, 3^rd Floor, San Francisco, CA 94105 USA

Contact person’s name, position and contact details: David Obed; Area Manager; Email – [email protected]; Main Phone:  +1 (415) 901-7000

Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Customer Relationship Management

3. Name: Rapid7

Address: 120 Causeway Street, Suite 400, Boston, MA 02114 (Global Headquarters)

Contact person’s name, position and contact details: Devon Beach; Email: [email protected]; Main Ph.: +1 (617) 247-1717; Product Support: +1 (866) 390-8113; Incident Response: +1 (844) 727-4347

Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Cybersecurity Solution – Scoped Services