Data Processing Agreement (DPA) and Sub-processors List

Introduction

Welcome to Shyft's Data Processing Agreement (DPA) and Sub-processors List. Here, we outline our approach to data processing and provide transparency regarding the third-party sub-processors involved in our operations.

What is a Third-Party Subprocessor?

A subprocessor is a vendor utilized by Shyft to process data on behalf of our customers, who act as the data controllers for that information.

Shyft's Process for Contracting with Subprocessors

At Shyft, we hold our sub-processors to rigorous standards, ensuring they comply with equivalent obligations outlined in our Data Processing Agreement (DPA). These obligations include:

• Processing data in accordance with the instructions provided by the data controller (our customers).
• Employing reliable personnel subject to contractual obligations regarding data privacy and security.
• Promptly notifying Shyft of any security breaches.
• Collaborating with Shyft to address requests from data controllers, data subjects, or data protection authorities.

Shyft's Infrastructure and Subprocessing Activities

Shyft maintains ownership or control over the infrastructure hosting both real-time and stored personal data. We may transfer personal data among data centers within a region to ensure optimal performance and availability. Additionally, we collaborate with select service sub-processors to deliver specific functionality.

Sub-Processors List

Below is a list of countries and legal entities engaged in processing and storing personal data on behalf of Shyft: