Subprocessors and Subcontractors

    SpringCM Inc. uses certain subprocessors (including members of the SpringCM Affiliates and third parties, as listed below) and subcontractors to assist it in providing the SpringCM Services as described in the Master Subscription Agreement (“MSSA”). Defined terms used herein shall have the same meaning as defined in the MSSA.

    Subprocessor Description

    A subprocessor is a third-party data processor engaged by SpringCM, including entities from within the SpringCM Affiliates, who has or potentially will have access to or process Service Data (which may contain Personal Data). SpringCM engages different types of subprocessors to perform various functions as explained in the tables below. SpringCM refers to third parties that do not have access to or process Service Data but who are otherwise used to provide the Services as “subcontractors” and not subprocessors.

    Due Diligence

    SpringCM undertakes to use a commercially reasonable selection process by which it evaluates the security, privacy and confidentiality practices of proposed subprocessors that will or may have access to or process Service Data.

    Contractual Safeguards

    SpringCM requires its subprocessors to satisfy equivalent obligations as those required from SpringCM (as a Data Processor) as set forth in SpringCM’s Data Processing Agreement (“DPA”), including but not limited to the following requirements:

    • Process Personal Data in accordance with data controller’s (i.e. Customer’s) documented instructions (as communicated in writing to the relevant subprocessor by SpringCM)

    • In connection with their subprocessing activities, use only personnel who are reliable and subject to a contractually binding obligation to observe data privacy and security, to the extent applicable, pursuant to applicable data protection laws

    • Provide regular training in security and data protection to personnel to whom they grant access to Personal Data

    • Implement and maintain appropriate technical and organizational measures (including measures consistent with those to which SpringCM is contractually committed to adhere insofar as they are equally relevant to the subprocessor’s processing of Personal Data on SpringCM’s behalf) and provide an annual certification that evidences compliance with this obligation. In the absence of such certification SpringCM reserves the right to audit the subprocessor

    • Promptly inform SpringCM about any actual or potential security breach

    • Cooperate with SpringCM in order to deal with requests from data controllers, data subjects or data protection authorities, as applicable

    This policy does not give Customers any additional rights or remedies and should not be construed as a binding agreement. The information herein is only provided to illustrate SpringCM’s engagement process for subprocessors as well as to provide the actual list of third party subprocessors, subcontractors and content delivery networks used by SpringCM as of the date of this policy (which SpringCM may use in the delivery and support of its Services). If you are a SpringCM Customer and wish to enter into our DPA, please email us at privacy@springcm.com.

    Process to Engage New Subprocessors:

    For all Customers who have executed SpringCM’s standard DPA, SpringCM will provide notice via this policy of updates to the list of subprocessors that are utilized or which SpringCM proposes to utilize to deliver its Services. SpringCM undertakes to keep this list updated regularly to enable its Customers to stay informed of the scope of subprocessing associated with the SpringCM Services. Pursuant to the DPA, a Customer can object in writing to the processing of its Personal Data by a new subprocessor in accordance to the terms of the executed DPA with a Customer.

     

    Subprocessors

    Service Specific Subprocessors

    Entity Name

    Purpose

    Applicable Services

    Entity Country

    Akamai Technologies, Inc.

    Akamai, Inc. (“Akamai”) provides content distribution, security and DNS services for web traffic transmitted to and from the Services. This allows SpringCM to efficiently manage traffic and secure the Services. The primary information Akamai has access to is information in and associated with the SpringCM website URL that the End-User is interacting with (which includes End-User IP address). All information (including Service Data) contained in web traffic transmitted to and from the Services is transmitted through Akamai systems, but Akamai does not have access to this information.

    Content Delivery Network, Internet Security, and Domain Name Servicers

    US

    Upland Software, Inc.

    Upland Software, Inc. provides digital fax services to allow an email to fax” functionality within SpringCM. It supports secure communications via HTTPS between the custom-programmed application and the Upland Software, Inc. server. Optional service.

    Internet Fax Provider

    US

     

    SpringCM Affiliate Subprocessors

    The following entities are members of the SpringCM Affiliates. Accordingly, they function as subprocessors to provide the Services.


    Name

    Description

    Country

    SpringCM Inc. 

    US Corporation

    US

    SpringCM Inc.

    UK Establishment of US Corporation Entity

    UK

    SpringCM Ro Development S.R.L.

    Wholly owned Romanian subsidiary of SpringCM

    RO

     

    Professional Service & Support Subprocessors

    Entity Name

    Purpose

    Applicable Services

    Entity Country

    Accenture LLP, a subsidiary of Accenture Holdings plc.

    Provide implementation services, integration services, migration services, and ongoing professional services.

    Professional Services

    US

    Accenture (UK) LTD

     Provide implementation services, integration services, migration services, and ongoing professional services. Professional Services UK

    Zendesk, Inc.

    Provides the SpringCM Support platform in order to address support requirements of the platform

    Customer Support Platform

    US

    Acumen Solutions, Inc. Provide implementation services, integration services, migration services, and ongoing professional services. Professional Services US
    Simplus LLC Provide implementation services, integration services, migration services, and ongoing professional services. Professional Services US
    Advanced Technology Group, Inc. (aka ATG) Provide implementation services, integration services, migration services, and ongoing professional services. Professional Services US
    Morae Global Corporation Provide implementation services, integration services, migration services, and ongoing professional services. Professional Services  US 
    Buan Consulting Inc Provide implementation services, integration services, migration services, and ongoing professional services. Professional Services US
    4C Consulting LTD Provide implementation services, integration services, migration services, and ongoing professional services. Professional Services UK
    Stria, LLC Provide implementation services, integration services, migration services, and ongoing professional services. Professional Services US 
    Archive Systems, Inc. d/b/a Access Provide implementation services, integration services, migration services, and ongoing professional services. Professional Services US
    SmartSheet Inc. Tool used for with customers and internally to track on projects for professional services engagements that cross multiple organizations. Collaboration Software US


    Subcontractors

    As explained above, SpringCM also uses certain “subcontractors” to assist in the operations necessary to provide the SpringCM Services as described in the Master Subscription Agreement. The following is a list (as of the date of this policy) of the names and locations of material third-party subcontractors. Subcontractors do not have access to Service Data.

    Data Center Colocation

    Entity Name

    Purpose

    Applicable Services

    Entity Country

    Equinix, Inc.

    Provider of cages private to SpringCM, environmental controls, and physical security controls to SpringCM hosting locations.

    Colocation Services

    US

    Equinix (UK) Ltd.

    Provider of cages private to SpringCM, environmental controls, and physical security controls to SpringCM hosting locations. Colocation Services UK

    Equinix (Netherlands) BV

     Provider of cages private to SpringCM, environmental controls, and physical security controls to SpringCM hosting locations. Colocation Services Netherlands

    Switch Communications Group L.L.C.

    Provider of cages private to SpringCM, environmental controls, and physical security controls to SpringCM hosting locations.

    Colocation Services

    US

     

    In addition to this, we have provided a listing of the Processors of data where SpringCM is the "Controller" where the reasons for processing are for Sales and Marketing purposes.

     

    Sales & Marketing Processors

    Entity Name

    Purpose

    Applicable Services

    Entity Country

    salesforce.com, inc.

    Used for Customer Relationship Management and the SpringCM Community.

    CRM Platform and Community Platform

    US

    Salesforce.com EMEA Limited

    Used for Customer Relationship Management and the SpringCM Community.

    CRM Platform and Community Platform

    UK

    HubSpot Inc.

    Hosting platform for marketing website

    Website Hosting

    US

    Wistia, Inc. Supports video for the marketing website Media streaming US
    Drift.com, Inc. Interactive tool for engagement for the marketing website Messaging and engagement tool US 
    SalesLoft, Inc.  Tool used to conduct email marketing activities Email campaign tool US 
    Boomset Inc. The platform used for various conference activities involving badge identification.  Event management software US 
    Eventbrite, Inc.  The platform used to provide tickets and present agreements to existing and prospective customers Event management ticketing service US 
    SurveyMonkey Inc.  The platform used to conduct surveys Survey tool US 
    SurveyMonkey Europe UC  The platform used to conduct surveys Survey tool Ireland
    Aha! Labs Inc. Product Management tool for the coordination of idea development with customers participating in our product feature development. Product Management Tool US 
    Skilljar Inc.  The platform by which training is conducted for users and partners creating solutions on the SpringCM platform Learning Management System  US
    Fonteva Tool used for event management for marketing activities Event Managmenet Tool US

     

    Last Modified: May 2018