Subprocessors List

This subprocessors statement is from Deloitte AG or Deloitte Consulting AG, companies registered in Switzerland with registered numbers CHE-101.377.666 and CHE-106.114.341 respectively. Both entities have registered offices at Pfingstweidstrasse 11, 8005 Zurich, Switzerland. Deloitte AG and Deloitte Consulting AG are affiliates of Deloitte NWE LLP, a member firm of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”). Deloitte refers to a Deloitte member firm, one of its related entities, or “DTTL”. Each Deloitte member firm is a separate legal entity and a member of DTTL. DTTL and Deloitte NWE LLP do not provide services to clients. Please see www.deloitte.com/about to learn more.

This subprocessors statement is required in line with Article 28 point 4 of the General Data Protection Regulation (GDPR) and intends to disclose the subprocessors assisting Deloitte in providing services, where Deloitte itself is acting as a data processor. Other member firms of the Deloitte network may also be considered subprocessors where Deloitte is acting as a data processor.

Deloitte engages different types of subprocessors to perform various functions. Deloitte undertakes to use a commercially reasonable selection process by which it evaluates the security, privacy and confidentiality practices of proposed subprocessors that will or may have access to or process data. The risk profile of subprocessors shall be determined through a combination of the completed self-assessment questionnaire and a review of the third party’s security and privacy controls. This includes but is not limited to the requirements to:

• process Personal Data in accordance with data controller’s documented instructions;
• in connection with their subprocessing activities, use only personnel who are reliable and subject to a contractually binding obligation to observe data privacy and security, to the extent applicable, pursuant to applicable data protection laws;
• provide regular training in security and data protection to personnel to whom they grant access to Personal Data;
• implement and maintain appropriate technical and organizational measures;
• promptly inform Deloitte about any actual or potential security breach; and
• cooperate with Deloitte in order to deal with requests from data controllers, data subjects or data protection authorities, as applicable.

The following is a list of the names and locations of Deloitte subprocessors, subcontractors and content delivery networks (including Member Firms of the Deloitte Network and third parties):

EU based service suppliers:

• EMEA GES RDC – Deloitte area and 3rd Floor, Sector 1, 011141, Bucharest, Romania
• Bucharest Consulting – Deloitte Tehnologie Srl, Pipera Nr 46d-46e-48 Etaj 3 Sector 2, Bucharest, Romania ERDC
• ADC Operations | Deloitte Audit SRL, 46D-46E-48 Pipera Road, B Building, 6th Floor – Deloitte, Sector 2, 20112, Bucharest, Romania
• Deloitte Tehnologie Srl, Pipera Nr 46d-46e-48 Etaj 3 Sector 2, Bucharest, Romania ERDC
• EDC Cyber Center Madrid - Cybersoc EMEA Center, SL, Torre Picasso - Plaza Pablo Ruiz Picasso 1, 28020 Madrid, España
• Cardiff DC (UK) - All Service Lines – operates under Deloitte LLP - Deloitte LLP, 5 Callaghan Square, Cardiff, CF10 5BT
• Belfast DC (UK) - All Service Lines – operates under Deloitte LLP - Deloitte LLP, 2 new Street Square London or for direct correspondence, 19 Bedford St Belfast bt2 7ej
• Rzeszow Consulting - Deloitte CE Business Services Sp. z.o.o., ul. Warszawska 18, 35-205 Rzeszów, Poland

Non-EU based service suppliers:

nternationally based service suppliers:

• Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109-5210, US
• Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, US
• MURAL by Tactivos, Inc., 2000 Broadway Street Apartment 1108 San Francisco, CA 94115, US
• Qualtrics by Qualtrics LLC, 333 W. River Park Drive, Provo, UT 84604, US
• Salesforce.com EMEA Limited – Floor 26 Salesforce Tower, 110 Bishopsgate, London, EC2N 4AY, UK
• SAP UK Limited – Clockhouse Place, Bedfont Road, Feltham, Middlesex, TW14 8HD, UK
• Zoom, San Jose, 55 Almaden Blvd, US

Swiss based service suppliers:

• Swisscom (Switzerland) Ltd, Business Customers, Alte Tiefenaustrasse 6, CH-3050 Bern
• Iron Mountain (Schweiz) AG, Obere Ey 4, 4657 Dulliken
  
• ISS Schweiz AG, Vulkanplatz 3, Postfach 8010 Zürich

For any general privacy or GDPR questions, you can contact us in the following ways:

• write to the Data Protection Officer - Deloitte AG Data Privacy Team, Deloitte AG, Pfingstweidstrasse 11, 8005 Zurich, Switzerland
• send an email to chdataprivacy@deloitte.ch
• For more details how Deloitte handles and shares your information, please check the general Deloitte Switzerland Privacy Statement: https://www2.deloitte.com/ch/en/footerlinks1/privacy.html