What is a Sub-Processor
A Sub-Processor is a third-party data processor engaged by Puzzel, including entities from within the Puzzel Group, who has or potentially will have access to or process Customer Data (which may contain Personal Data). Puzzel engages different types of Sub-Processors to perform various functions as explained in the tables below. Puzzel refers to third-parties that do not have access to or process Customer Data but who are otherwise used to provide the Services as “Subcontractors” and not Sub-Processors.
Puzzel undertakes to use a commercially reasonable selection process by which it evaluates the security, privacy and confidentiality practices of proposed Sub-Processors that will or may have access to or process Customer Data.
Puzzel requires its Sub-Processors to satisfy equivalent obligations as those required from Puzzel (as a Data Processor) as set forth in Puzzel’s Data Processing Agreement (“DPA”), including but not limited to the requirements to:
- Process Personal Data in accordance with data controllers (i.e. Customers) documented instructions (as communicated in writing to the relevant Sub-Processor by Puzzel);
- In connection with their sub-processing activities, use only personnel who are reliable and subject to a contractually binding obligation to observe data privacy and security, to the extent applicable, pursuant to applicable data protection laws;
- Provide regular training in security and data protection to personnel to whom they grant access to Personal Data;
- Implement and maintain appropriate technical and organizational measures (including measures consistent with those to which Puzzel is contractually committed to adhere to insofar as they are equally relevant to the Sub-Processor’s processing of Personal Data on Puzzel’s behalf) and provide an annual certification that evidences compliance with this obligation. In the absence of such certification Puzzel reserves the right to audit the Sub-Processor;
- Promptly inform Puzzel about any actual or potential security breach; and
- Cooperate with Puzzel in order to deal with requests from data controllers, data subjects or data protection authorities, as applicable.
This policy does not give Customers any additional rights or remedies and should not be construed as a binding agreement. The information herein is only provided to illustrate Puzzel’s engagement process for Sub-Processors as well as to provide the actual list of third-party Sub-Processors and Subcontractors used by Puzzel as of the date of this policy (which Puzzel may use in the delivery and support of its Services).
If you are a Puzzel Customer and wish to enter into our DPA, please speak to your key account manager or email us at email@example.com.
Process to Engage New Sub-Processors:
Puzzel will provide notice to customers of updates to the list of Sub-Processors that are utilized or which Puzzel proposes to utilize to deliver its Services. Puzzel undertakes to keep this list updated regularly to enable its Customers to stay informed of the scope of sub-processing associated with the Puzzel Services.
Pursuant to the DPA, a Customer may object in writing to the processing of its Personal Data by a new Sub-Processor within thirty (30) days following the update of this policy and such objection shall describe Customer’s legitimate reason(s) for objection. If the Customer does not object during such time period, the new Sub-Processor(s) shall be deemed accepted.
If a Customer objects to the use of a new Sub-Processor pursuant to the process provided under the DPA, Puzzel shall have the right to cure the objection through one of the following options (to be selected at Puzzel’s sole discretion):
(a) Puzzel will cease to use the new Sub-Processor with regard to Personal Data;
(b) Puzzel will take the corrective steps requested by Customer in its objection (which remove Customer’s objection) and proceed to use the Sub-Processor to process Personal Data; or
(c) Puzzel may cease to provide or Customer may agree not to use (temporarily or permanently) the particular aspect of a Puzzel Service that would involve use of the Sub-Processor to process Personal Data.
Termination rights, as applicable and agreed, are set forth exclusively in the DPA.
The following is an up-to-date list (as of the date of this policy) of the names and locations of Puzzel Sub-Processors and Subcontractors (including members of the Puzzel Group and third-parties):
Puzzel works with certain third-parties to provide specific functionality within the Services. These providers are the Sub-Processors set forth below. In order to provide the relevant functionality these Sub-Processors access Customer Data. The following table describes the legal entities engaged by Puzzel in the processing of Customer Data and their respective processing locations. Their use and access are limited to the applicable Services.
Currently, the systems used for hosting Customer Data for the Services are located in two separate co-location facilities in Norway and in the infrastructure of the Sub-Processors listed below.
|Entity Name||Purpose and Description||Applicable Services||Processing Location|
|Microsoft||Microsoft provides the cloud service infrastructure for the listed Services and function as a hosting partner for Puzzel. The Services are developed and managed by Puzzel.||ChatBot, Social Media||Regions: West- and North Europe|
|Cention Group SB||Provides the Service “Puzzel Ticketing, powered by Cention” which allows for queueing and filtering of e-mails as conversations, based on e-mail address, domain address, subject, or body text. Cention has access to Customers’ and End-Users’ information as needed to deliver the messages sent through the connectors. This includes Customer Data contained in the messages and the Personal Data of Customers’ Agents and End-Users as needed to send and deliver the messages. This product is hosted in the Cention cloud-service or in Customer premises.||Puzzel Ticketing (powered by Cention)||Ireland (AWS)|
|Verint Systems||The Verint cloud-based workforce management (WFM) solution is installed in Puzzel Data Centres and maintained and operated by Puzzel Personnel.
Verint consultants are used specifically for implementation of Customer solutions and technical support. Verint engineers do not have default access to Customer Data, but are granted access, under management oversight, only when necessary.
|Verint specific Services including WFM, Speech Analytics, QM and Advanced Scorecards||Norway|
Puzzel Group Sub-Processors
The following entities are members of the Puzzel Group. Accordingly, they function as Sub-Processors to provide the Services.
|Entity Name and Country||Address||Purpose and Description|
|Puzzel AS – Norway
(Company nr: 916 938 705)
|Fredrik Selmers vei 3, 0663 Oslo||Responsible for the Puzzel Contact Centre Platform and all other Services.|
|Puzzel AB – Sweden
(Company nr: 556579-4384)
|Gustavslundsvägen 145, S-167 51 Bromma||Technical Support|
|Puzzel A/S – Denmark
(Company nr: 25254864)
|Digevej 114, 1, 2300 København S||Technical Support|
|Puzzel Ltd – UK
(Company nr: 4124967)
|Herschel House, 58 Herschel Street, Slough, SL1 1PG, London||Technical Support|
|Puzzel Sofia EDA – Bulgaria
(Company nr: 204077170)
|5, Lachezar Stanchev Str., Sopharma Business Towers, B, 17th fl.||Technical Support|
|Puzzel OY – Finland
(Company nr: 088979)
|Bulevardi street 21
As explained above, Puzzel also uses certain “Subcontractors” to assist in the operations necessary to provide the Puzzel Services as described in the Master Agreement. The following is a list (as of the date of this policy) of the names and locations of material third-party Subcontractors. Subcontractors do not process or access Customer Data.
|Entity Name||Purpose||Entity Country|
|Verizon||Data Centre Co-location Service (Puzzel Data Centre 1). Puzzel owns or controls access to the infrastructure that Puzzel uses to host and process Customer Data submitted to the Services.||Norway|
|Digiplex||Data Centre Co-location Service (Puzzel Data Centre 1). Puzzel owns or controls access to the infrastructure that Puzzel uses to host and process Customer Data submitted to the Services.||Norway|
|T3CH.com LLC||Status platform – Customer notifications (Status.io)||United States|