What is a Sub-Processor
A Sub-Processor is a third-party data processor engaged by Puzzel, including entities from within the Puzzel Group, who has or potentially will have access to or process Customer Data (which may contain Personal Data). Puzzel engages different types of Sub-Processors to perform various functions as explained in the tables below. Puzzel refers to third-parties that do not have access to or process Customer Data but who are otherwise used to provide the Services as “Subcontractors” and not Sub-Processors.
Puzzel undertakes to use a commercially reasonable selection process by which it evaluates the security, privacy and confidentiality practices of proposed Sub-Processors that will or may have access to or process Customer Data.
Puzzel requires its Sub-Processors to satisfy equivalent obligations as those required from Puzzel (as a Data Processor) as set forth in Puzzel’s Data Processing Agreement (“DPA”), including but not limited to the requirements to:
- Process Personal Data in accordance with data controllers (i.e. Customers) documented instructions (as communicated in writing to the relevant Sub-Processor by Puzzel);
- In connection with their sub-processing activities, use only personnel who are reliable and subject to a contractually binding obligation to observe data privacy and security, to the extent applicable, pursuant to applicable data protection laws;
- Provide regular training in security and data protection to personnel to whom they grant access to Personal Data;
- Implement and maintain appropriate technical and organizational measures (including measures consistent with those to which Puzzel is contractually committed to adhere to insofar as they are equally relevant to the Sub-Processor’s processing of Personal Data on Puzzel’s behalf) and provide an annual certification that evidences compliance with this obligation. In the absence of such certification Puzzel reserves the right to audit the Sub-Processor;
- Promptly inform Puzzel about any actual or potential security breach; and
- Cooperate with Puzzel in order to deal with requests from data controllers, data subjects or data protection authorities, as applicable.
This policy does not give Customers any additional rights or remedies and should not be construed as a binding agreement. The information herein is only provided to illustrate Puzzel’s engagement process for Sub-Processors as well as to provide the actual list of third-party Sub-Processors and Subcontractors used by Puzzel as of the date of this policy (which Puzzel may use in the delivery and support of its Services).
If you are a Puzzel Customer and wish to enter into our DPA, please speak to your key account manager or email us at firstname.lastname@example.org.
Process to Engage New Sub-Processors
Puzzel will provide notice to customers of updates to the list of Sub-Processors that are utilized or which Puzzel proposes to utilize to deliver its Services. Puzzel undertakes to keep this list updated regularly to enable its Customers to stay informed of the scope of sub-processing associated with the Puzzel Services.
Pursuant to the DPA, a Customer may object in writing to the processing of its Personal Data by a new Sub-Processor within thirty (30) days following the update of this policy and such objection shall describe Customer’s legitimate reason(s) for objection. If the Customer does not object during such time period, the new Sub-Processor(s) shall be deemed accepted.
If a Customer objects to the use of a new Sub-Processor pursuant to the process provided under the DPA, Puzzel shall have the right to cure the objection through one of the following options (to be selected at Puzzel’s sole discretion):
- Puzzel will cease to use the new Sub-Processor with regard to Personal Data;
- Puzzel will take the corrective steps requested by Customer in its objection (which remove Customer’s objection) and proceed to use the Sub-Processor to process Personal Data; or
- Puzzel may cease to provide or Customer may agree not to use (temporarily or permanently) the particular aspect of a Puzzel Service that would involve use of the Sub-Processor to process Personal Data.
Termination rights, as applicable and agreed, are set forth exclusively in the DPA.
The following is an up-to-date list (as of the date of this policy) of the names and locations of Puzzel Sub-Processors and Subcontractors (including members of the Puzzel Group and third-parties):
Puzzel works with certain third-parties to provide specific functionality within the Services. These providers are the Sub-Processors set forth below. In order to provide the relevant functionality these Sub-Processors access Customer Data. The following table describes the legal entities engaged by Puzzel in the processing of Customer Data and their respective processing locations. Their use and access are limited to the applicable Services.
Currently, the systems used for hosting Customer Data for the Services are located in two separate co-location facilities in Norway and in the infrastructure of the Sub-Processors listed below.
|Subprocessor||Purpose and Description||Services||Processing Location|
|Auth0||Provides the Single Sign-On Service.||Single Sign-On (SSO)||EU (AWS)|
|Boost.ai||Chatbot framework||Chatbot||Ireland (AWS)|
|Microsoft Corporation||Puzzel delivers the Services from Microsoft Azure as a hosting provider to Puzzel.||All||EU/EEA, Netherlands, Ireland + UK for UK customers|
|Signicat||Signicat provides the Identity & Verification Services to identify subjects. Signicat is a provider of Digital Identity Verification, Authentication, and Signing solutions.||Identity & Verification Services||Norway|
|Teleopti||Teleopti provides Work Force Management Service. Teleopti WFM maximizes contact centre planning with multichannel forecasting, multi-skill scheduling, employee-empowering functionality and self-service, competence development, and monitoring of real-time and past activities.||Work Force Management (Teleopti)|
|Amazon Web Services||Ticketing is hosted in AWS.||Ticketing||EU (AWS)|
Puzzel Group Sub-Processors
The following entities are members of the Puzzel Group. Accordingly, they function as Sub-Processors to provide the Services.
|Entity Name||Address||Entity Country||Description|
(Company nr: 916 938 705)
|Fredrik Selmers vei 3, 0663 Oslo||Norway||Puzzel AS is responsible for developing, operating and maintaining the Services. Puzzel AS is also responsible for applicable third-party Subprocessors listed below|
(Company nr: 556579-4384)
|Gustavslundsvägen 145, S-167 51 Bromma||Sweden||Puzzel AS subsidiary – technical support|
(Company nr: 25254864)
|H. J. Holstvej 5 A, 2.sal, 2605 Brøndby||Denmark||Puzzel AS subsidiary – technical support|
|Puzzel Sofia EAD
(Company nr: 204077170)
|5, Lachezar Stanchev Str., Sopharma Business Towers, B, 17th fl.||Bulgaria||Puzzel AS subsidiary – technical support|
(Company nr: 088979)
|Bulevardi street 21|
|Finland||Puzzel AS subsidiary – technical support|
(Company nr: 4124967)
|22 Tudor Street, Blackfriars, London, EC4Y 0AY
|UK||Puzzel AS subsidiary – technical support|
|Puzzel Scotland Ltd
(Company nr: SC234177)
|The Hub, 45 Vicar Street, Falkirk, FK1 1LL, Scotland||UK||Puzzel Ltd subsidiary – technical support and development|