DATAx Subprocessors

This page lists the subprocessors (third-party service providers) that ContractorCTO LLC (“DATAx”, “we”, “us”, or “our”) engages to process customer data on our behalf in connection with providing the DATAx Service.

As stated in our Data Processing Addendum (DPA), we will provide at least 30 days' advance notice before adding or replacing a subprocessor. Customers may subscribe to updates by emailing [email protected].

What is a Subprocessor?

A subprocessor is a third-party data processor engaged by DATAx who has or potentially will have access to or process Customer Data (which may contain personal data). DATAx enters into data processing agreements with each subprocessor that impose data protection obligations consistent with our commitments to customers under our DPA and applicable data protection laws.

Current Subprocessors

The following table lists all active subprocessors as of the date above:

Data Protection and Compliance

All subprocessors listed above:

• Are bound by written agreements that impose data protection obligations consistent with our DPA and applicable data protection laws
• Implement appropriate technical and organizational security measures to protect personal data
• Are required to process personal data only in accordance with our documented instructions
• Are required to notify us of any personal data breaches
• Comply with applicable data protection laws, including GDPR, UK GDPR, and CCPA where applicable

International Data Transfers

Where subprocessors are located outside the European Economic Area (EEA), UK, or Switzerland, we ensure appropriate safeguards are in place for international data transfers, including:

• EU Standard Contractual Clauses (SCCs)
• Adequacy decisions by the European Commission
• Binding Corporate Rules or equivalent mechanisms
• Other legally recognized transfer mechanisms as applicable

Subprocessor Changes

DATAx reserves the right to add, remove, or replace subprocessors from time to time as necessary to provide and improve the Service. When we engage a new subprocessor or replace an existing subprocessor, we will:

• Update this page at least 30 days before the new subprocessor begins processing Customer Data
• Send email notifications to customers who have subscribed to subprocessor updates
• Provide in-app notifications when significant subprocessor changes occur

If you object to a new subprocessor on reasonable data protection grounds, you may terminate the affected Service within 30 days of notice and receive a pro-rata refund of prepaid fees, as described in our DPA and Terms of Service.

Subscribe to Subprocessor Updates

To receive email notifications when we update this subprocessor list, please contact us at [email protected] with the subject line “Subscribe to Subprocessor Updates”.

Version History

Additional Information

Security Certifications

Many of our subprocessors maintain industry-standard security certifications and undergo regular third-party audits, including:

• SOC 2 Type II
• ISO 27001
• ISO 27017 (cloud security)
• ISO 27018 (cloud privacy)
• PCI DSS (for payment processing)

Third-Party Tools Not Listed

This list includes only subprocessors that have access to or process Customer Data. The following types of third-party tools are not listed here because they do not process Customer Data:

• Internal development and productivity tools used by DATAx employees
• Analytics tools that process only anonymized, aggregated data
• Marketing and advertising platforms
• Services that only process DATAx's own business data