Third Party Subprocessors

Effective: 04/01/2023

What is a Third-Party Subprocessor?

A subprocessor is a third-party vendor CIS uses to process data on behalf of our customers, who are the data controllers of that data.

Purposes for which CIS collects and Uses Personal Information

• Providing you with the CIS applications, information, and websites for which you have registered, as well as any products or services, or support requested;
• Publish listings of CIS SecureSuite members and CIS Controls Supporters on our website which, in the case of individual members, includes names and organizational affiliations;
• Publish testimonials of CIS products and service on our website provided by individuals, which would include name, title and affiliate organization;
• Gain a better understanding how our website, product or services are being used so that we can improve them and engage with users;
• Diagnosing problems;
• Sending you business messages and marketing related to payments or expiration of subscriptions;
• Sending you information about CIS products, services, opportunities, updates, advisories, special offers, and similar information;Conducting market research about our customers, and the effectiveness of our marketing campaigns.

Purposes for which CIS collects and Uses Non-Personal Information

• The type of browser and operating system you use when you visit this site;
• The date and time when you visit this site;
• The webpage and services you access at this site;
• The forms that you download from this website;
• Additionally, non-personal information such as a company or governmental entity name and address. IP address may be provided when registering or signing up for CIS products or services. This information is used to determine eligibility for certain products or services.

CIS’s Process for Contracting with Third-party Subprocessors

CIS requires its third-party subprocessors to satisfy equivalent obligations as those required from CIS:

• process personal data following data controller’s documented instructions;
• in connection with the subprocessing activities, use only personnel who are reliable and subject to a contractually binding obligation to observe data privacy and security, to the extent applicable, under applicable data protection laws;
• promptly inform CIS about any security breach; and
• cooperate with CIS to address requests from data controllers, data subjects, or data protection authorities, as applicable.
  

The following table describes the countries and legal entities engaged in the processing and storage of personal data by CIS acting as a data processor on behalf of its customers, the data controllers.

 

Privacy Notice Subprocessor Revision History

Date of Change	Change
04/01/2023	Added Snowflake, Oracle, Zoom, and Fivetran as subprocessors