Last Updated: August 1, 2023

To support the delivery of our Services, ZenGRC, Inc. (“ZenGRC”) (or one of its Affiliates listed below) uses services providers (each, a “Subprocessor”) that may store or process Customer Data which may contain personal data.

ZenGRC requires its subprocessors to satisfy equivalent obligations as those required from ZenGRC (as a Data Processor) as outlined in ZenGRC’s Data Processing Agreement (DPA), including but not limited to the requirements to:

• process personal data following data controller’s (i.e., Customer’s) documented instructions (as communicated in writing to the relevant subprocessor by ZenGRC);
• in connection with the subprocessing activities, use only personnel who are reliable and subject to a contractually binding obligation to observe data privacy and security, to the extent applicable, under applicable data protection laws;
• promptly inform ZenGRC about any security breach; and
• cooperate with ZenGRC to address requests from data controllers, data subjects, or data protection authorities, as applicable.

The following table describes the legal entities acting as a subprocessor for ZenGRC, the service that subprocessor relates to, the function that subprocessor performs on behalf of ZenGRC, the categories of personal data processed by that subprocessor on behalf of ZenGRC, the location of the processing, the adequacy mechanism utilized between that subprocessor and ZenGRC, and a link to the public DPA that subprocessor offers.

Third Party Risk Management is conducted annually on all subprocessors.

ZenGRC Subsidiaries

Depending on the geographic location of a Customer or their authorized users, and the nature of the Services provided, ZenGRC may also engage our subsidiary to deliver some or all of the Services to a Customer.