Legal

Subprocessors List

Last reviewed: January 2019

This subprocessors statement is from Deloitte AG or Deloitte Consulting AG, companies registered in Switzerland with registered numbers CHE-101.377.666 and CHE-106.114.341 respectively. Both entities have registered offices at General Guisan-Quai 38, 8002 Zurich, Switzerland. Deloitte AG and Deloitte Consulting AG are affiliates of Deloitte NWE LLP, a member firm of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”). Deloitte refers to a Deloitte member firm, one of its related entities, or “DTTL”. Each Deloitte member firm is a separate legal entity and a member of DTTL. DTTL and Deloitte NWE LLP do not provide services to clients. Please see www.deloitte.com/about to learn more.

This subprocessors statement is required in line with Article 28 point 4 of the General Data Protection Regulation (GDPR) and intends to disclose the subprocessors assisting Deloitte in providing services, where Deloitte itself is acting as a data processor. Other member firms of the Deloitte network may also be considered subprocessors where Deloitte is acting as a data processor.

Deloitte engages different types of subprocessors to perform various functions. Deloitte undertakes to use a commercially reasonable selection process by which it evaluates the security, privacy and confidentiality practices of proposed subprocessors that will or may have access to or process data. The risk profile of subprocessors shall be determined through a combination of the completed self-assessment questionnaire and a review of the third party’s security and privacy controls. This includes but is not limited to the requirements to:

  • process personal data in accordance with data controller’s documented instructions;
  • in connection with their subprocessing activities, use only personnel who are reliable and subject to a contractually binding obligation to observe data privacy and security, to the extent applicable, pursuant to applicable data protection laws;
  • provide regular training in security and data protection to personnel to whom they grant access to personal data;
  • implement and maintain appropriate technical and organizational measures;
  • promptly inform Deloitte about any actual or potential security breach; and
  • cooperate with Deloitte in order to deal with requests from data controllers, data subjects or data protection authorities, as applicable.

The following is a list of the names and locations of Deloitte subprocessors, subcontractors and content delivery networks (including Member Firms of the Deloitte Network and third parties):

EU based service suppliers:

  • EMEA GES RDC – Deloitte area and 3rd Floor, Sector 1, 011141, Bucharest, Romania
  • Bucharest Consulting – Deloitte Tehnologie Srl, Pipera Nr 46d-46e-48 Etaj 3 Sector 2, Bucharest, Romania ERDC
  • ADC Operations | Deloitte Audit SRL, 46D-46E-48 Pipera Road, B Building, 6th Floor – Deloitte, Sector 2, 20112, Bucharest, Romania
  • Deloitte Tehnologie Srl, Pipera Nr 46d-46e-48 Etaj 3 Sector 2, Bucharest, Romania ERDC
  • EDC Cyber Center Madrid - Cybersoc EMEA Center, SL, Torre Picasso - Plaza Pablo Ruiz Picasso 1, 28020 Madrid, España
  • Cardiff DC (UK) - All Service Lines – operates under Deloitte LLP - Deloitte LLP, 5 Callaghan Square, Cardiff, CF10 5BT
  • Belfast DC (UK) - All Service Lines – operates under Deloitte LLP - Deloitte LLP, 2 new Street Square London or for direct correspondence, 19 Bedford St Belfast bt2 7ej
  • Rzeszow Consulting - Deloitte CE Business Services Sp. z.o.o., ul. Warszawska 18, 35-205 Rzeszów, Poland

Non-EU based service suppliers:

Function

Contracting Entity

Place of business

 

Consulting

 

Deloitte Consulting India Projects LP

30 Rockefeller Plaza, New York,
New york, USA 10112

 

Audit and Advisory

 

Deloitte & Touche India Projects LP

 

30 Rockefeller Plaza, New York, New York, USA 10112

 

FA

 

Deloitte India JV - Deloitte Global Financial Advisory India Private Limited

 

Indiabulls Finance Centre, Tower 3, 27th - 32nd Floor, Elphinstone Mills Compound, Senapati Bapat Marg, Elphinstone Road (West), Mumbai – 400013

 

Tax

 

Deloitte Tax India Projects LP (US owned)

 

30 Rockefeller Plaza, New York, New York, USA 10112

 

Enabling Areas

 

Deloitte Services India Projects LP

 

30 Rockefeller Plaza, New York, New York, USA 10112

 

Telecommunication

 

Swisscom AG

 

Ostermundigenstrasse 99, 3050 Bern, Switzerland

For any general privacy or GDPR questions, you can contact us in the following ways:

  • writing to Head of Deloitte Business Security, Deloitte AG, General-Guisan-Quai 38, 8022 Zurich, Switzerland, or
  • sending an email to ConsultingQRM@deloitte.ch