What are Sub-Processors?

Sub-processors are third-party service providers that Virvell engages to process customer data on our behalf. Under our Data Processing Agreement (DPA), we maintain full transparency about all sub-processors who may have access to your data.

We ensure that all sub-processors:

• Enter into written agreements with data protection obligations substantially similar to our DPA
• Implement appropriate technical and organizational security measures
• Process data only as instructed by Virvell and our customers
• Comply with applicable data protection laws (GDPR, PIPEDA, CCPA, etc.)

Current Sub-Processors

Adding New Sub-Processors

When we engage a new sub-processor, we:

1. Notify customers via email at least 30 days before authorization
2. Update this page with full details about the new sub-processor
3. Provide objection period of 5 business days as outlined in our DPA
4. Ensure compliance with the same data protection standards as existing sub-processors

Data Protection Safeguards

All sub-processors are contractually required to:

• Process data only on Virvell's documented instructions
• Implement appropriate security measures (encryption, access controls, monitoring)
• Assist with data subject rights requests (access, deletion, portability)
• Notify Virvell immediately of any data breaches
• Delete or return data upon termination of services
• Allow audits and inspections of their data processing activities

International Data Transfers

Some sub-processors are located outside your jurisdiction. For transfers from the EU/EEA, UK, or Switzerland, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK Addendum for UK GDPR compliance
• Swiss Addendum for Swiss FADP compliance
• Additional safeguards including encryption and data minimization

See our Data Processing Agreement for full details on cross-border transfer mechanisms.