Data Importer (“Blueboard”) uses certain Subprocessors to assist in providing limited services on its behalf. Any such Subprocessors will be permitted to obtain client personal data only to deliver the services Blueboard has retained them to provide, and they are prohibited from using personal data for any other purposes.
A Subprocessor is a third-party data processor engaged by Blueboard who has or potentially will have access to or process personal data.
Blueboard undertakes to use a commercially reasonable selection process by which it evaluates the security, privacy and confidentiality practices of Subprocessors that will or may have access to or process personal data. Blueboard requires its Subprocessors to satisfy equivalent obligations as those required from Blueboard (as a data processor) as set forth in Blueboard’s Privacy Policy, available at www.blueboard.com/privacy.
The following list set forth below is a current list (as of the date of this Subprocessors document) of the names, purposes and durations of subprocessing and locations of Blueboard’s Subprocessors. Such Subprocessors shall be approved and consented to by Data Exporter (“Client”).
Blueboard may remove or appoint suitable and reliable other Subprocessors as follows:
- Blueboard will inform Client by electronic means at least 30 days in advance of granting access to personal data to Subprocessor (except for Emergency Replacements as defined below) of any changes to the List of Subprocessors.
- If Client has a legitimate, material reason to object to Blueboard’s use of a Subprocessor, Client shall notify Blueboard thereof within fifteen (15) days after receipt of Blueboard’s notice. Client’s objection must be in writing and sent via electronic message to compliance@blueboard.com.
- If Client does not object during such time period, the new Subprocessor(s) shall be agreed and consented to by Client, also according to Clauses 9 and 12 of the Standard Contractual Clauses.
- If Client objects to the use of the Subprocessor concerned, Blueboard shall have the right to cure the objection through one of the following options: (i) Blueboard will abort its plans to use the Subprocessor with regard to Client’s personal data; or (ii) Blueboard will take the corrective steps requested by Client in its objection (which remove Client’s objection) and proceed to use the Subprocessor with regard to Client’s personal data; or (iii) Blueboard may cease to provide or Client may agree not to use (temporarily or permanently) the particular aspect of the service that would involve use of the Subprocessor with regard to Client’s personal data.
- “Emergency Replacement” refers to a sudden replacement of a Subprocessor where such change is outside of Blueboard’s reasonable control (such as if the Subprocessor ceases business, abruptly discontinues service to Blueboard, or breaches its contractual duties owed to Blueboard). In such case, Blueboard will inform Client of the replacing of Subprocessor as soon as practical and the process to formally appoint such Subprocessor defined above shall be triggered.
