This Annex forms part of, and is incorporated into, the Data Processing Agreement between the Controller and the Processor (the "DPA"). It lists the Sub-processors engaged by Haku Labs Ltd in the delivery of its platform and services, for which the Controller provides general written authorisation under clause 5.4.1 of the DPA. Terms defined in the DPA have the same meaning in this Annex.
Each Sub-processor listed in section 2 has been assessed for compliance with the Data Protection Laws, and a written agreement is in place with each imposing data protection obligations substantially equivalent to those imposed on the Processor under the DPA.
1. Scope of this Annex
1.1 Clause 2 of the DPA defines a Sub-processor as any third party engaged by the Processor to process Controller Personal Data, and defines Controller Personal Data so as expressly to exclude Haku Sourced Data.
1.2 Section 2 accordingly lists the vendors that receive Controller Personal Data. Those vendors are Sub-processors for the purposes of clause 5.4, and the Controller's rights of notification and objection under that clause apply to them.
1.3 Section 3 lists, for transparency only, the vendors engaged by the Processor in its capacity as independent controller of Haku Sourced Data under clause 3.2. Those vendors receive only company-level identifiers, publicly available web content, or Haku Sourced Data. They do not receive Controller Personal Data, they are not Sub-processors for the purposes of clause 5.4, and the rights of notification and objection under that clause do not extend to them. They are also disclosed in the Processor's transparency notice published under Article 14 UK GDPR.
2. Sub-processors of Controller Personal Data
3. Vendors Engaged by the Processor as Independent Controller
Disclosed for transparency under clause 3.2 of the DPA. None of the following receives Controller Personal Data.
4. Changes to this Annex
4.1 The Processor may update this Annex in accordance with clause 5.4 of the DPA. The Processor shall notify the Controller at least thirty (30) days before a new Sub-processor commences processing of Controller Personal Data, and the Controller may object in accordance with clauses 5.4.3 and 5.4.4.
4.2 The Processor maintains the register described in Annex II, paragraph 5.2, and shall make it available to the Controller on reasonable request in accordance with clause 7.1 of the DPA.