Sub Processor Policy

RLDatix uses certain Sub-processors (including members of the RLDatix Group and third parties, as listed below) and content delivery networks to assist it in providing the RLDatix Services as described in the Master Services Agreement (“MSA”). Defined terms used herein shall have the same meaning as defined in the MSA.

What is a Sub-processor

A Sub-processor is a third-party data processor engaged by RLDatix, including entities from the RLDatix Group, who receives data (which may contain personal data) from RLDatix for Processing on behalf of our Customers and in accordance with our Customers' instructions (as communicated by RLDatix) and the terms of its written subcontract. RLDatix engages different types of Sub-processors to perform various functions as explained in the tables below.

Due Diligence

RLDatix undertakes to use a commercially reasonable selection process by which it evaluates the security, privacy and confidentiality practices of proposed Sub-processors.

Contractual Safeguards

RLDatix generally requires its Sub-processors to satisfy equivalent obligations as those required from RLDatix (as a Data Processor) including but not limited to the requirements to:

• Process Personal Data in accordance with data controller’s (i.e., Subscriber’s) documented instructions (as communicated in writing to the relevant Sub-processor by RLDatix);
• In connection with their sub-processing activities, use only personnel who are reliable and subject to a contractually binding obligation to observe data privacy and security, to the extent applicable, pursuant to applicable data protection laws;
• Provide regular training in security and data protection to personnel to whom they grant access to Personal Data;
• Implement and maintain appropriate technical and organizational measures (including measures consistent with those to which RLDatix is contractually committed to adhere to insofar as they are equally relevant to the Sub-processor’s Processing of Personal Data on RLDatix’s behalf) and provide an annual certification that evidences compliance with this obligation. In the absence of such certification RLDatix reserves the right to audit the Sub-processor;
• Promptly inform RLDatix about any actual or potential security breach; and
• Cooperate with RLDatix in order to deal with requests from data controllers, data subjects or data protection authorities, as applicable.

Sub-processors which incidentally have access to your service data and are used to provide specific features or components of the product outside of the core hosting of service data are regularly reviewed by RLDatix to ensure they work towards implementing each of the standards described in this Section. However, these specific sub-processors may not currently meet all of the measures identified above. 

This policy does not give Customers any additional rights or remedies and should not be construed as a binding agreement. The information herein is only provided to illustrate RLDatix’s engagement process for Sub-processors as well as to provide the actual list of third-party sub-processors and content delivery networks used by RLDatix as of the date of this policy (which RLDatix may use in the delivery and support of its services).

Process to Engage New Sub-processors

RLDatix will provide notice via this policy of updates to the list of Sub-processors that are utilized or which RLDatix proposes to utilize to deliver its Services. RLDatix will keep this list updated regularly to enable its Customers to stay informed of the scope of sub-processing associated with the RLDatix Services. RLDatix Customers may subscribe to receive notifications of updates to this policy by clicking “Follow” at the top of this policy.

A Customer may object in writing to the Processing of its Personal Data by a newly appointed Sub-processor within thirty (30) days following the update of this policy and such objection shall describe the legitimate reason(s) for this objection.  If a Customer does not object during such time period, or if the objection is not legitimate, the new Sub-processor(s) shall be deemed accepted.

If a Customer objects to the use of a newly appointed Sub-processor pursuant to the process above, RLDatix shall have the right to cure the objection through one of the following options (to be selected at RLDatix’s sole discretion) by either:

• instructing the sub-processor to cease the processing of Customer's Personal Data; or 
• allowing Customer to terminate their MSA and any related services agreement with RLDatix and provide it with a pro rata reimbursement of any sums paid in advance for Services to be provided, but not yet received by Customer as of the effective date of termination.

The following is an up-to-date list (as of the date of this policy) of the names, entity type, and locations of RLDatix sub-processors and content delivery networks (including members of the RLDatix Group and third parties):