Protiviti GDPR Subprocessor Notification

Where Protiviti EOOD (“we” or “Protiviti”) is appointed as a data processor when performing services for our clients, we are required by Article 28 of the EU General Data Protection Regulation (GDPR) to obtain the prior specific or general written authorization of our client (the data controller) for the appointment of any sub-processors.

The tables below contain the list of material third-party sub-processors used across Protiviti products and services (as of the date of last update stated below). To the extent these entities are engaged for services provided to clients, the Protiviti affiliate entities may also be considered sub-processors where Protiviti is acting as a data processor.

You can receive updates regarding the sub-processors we engage, updated periodically, by subscribing to the Sub-processor Notification Subscription Service by providing your email below.

Last updated: 6 August 2024

Sub-processor List

Material sub-processors

Sub-processor Notification Subscription Service Form:

Subscribing to the Sub-processor Notification Subscription Service allows Protiviti to send automated communications related to any changes to our material sub-processors. You may unsubscribe from these sub-processor notifications at any time via the link provided in the email alerts. If you unsubscribe, you will no longer be notified of changes to our sub-processors.

Subscribing to our Notification: This statement covers your inclusion in the notifications for the Protiviti GDPR sub-processor updates. This notification subscription service is managed by Protiviti. When subscribing, you will receive information each time Protiviti updates its sub-processor list. Your information will be stored in our Eloqua platform to manage the subscription list, unsubscribe requests, and to send out the email notifications.

Categories of personal data processed: Your email address, the country from the site in which you’ve subscribed, along with the date/time of your subscription.

Purpose of processing: We process your email in order to send the notification to you. We process the date & time of your subscription to confirm when you subscribed. We process your country to ensure you receive the appropriate notifications from the correct Protiviti entity in the appropriate language.

Data source: This data is collected directly from you via the subscription form provided on our website and using the technical data transmitted through the subscription form.

Obligation to provide data: You are under no legal or contractual obligations to provide this data. If you do not provide this data, we will not be able to send you these notifications of changes to our sub-processors.

Legal basis: We process this data based on your consent to processing for a specific purpose according to Article 6(1)(a) UK GDPR which you have given via submission of this form. You may revoke your consent to the processing of the personal data you provided when submitting this form at any time. To do so, please click the unsubscribe link contained in each email or contact [email protected]. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Duration of data retention: We will retain your email until you unsubscribe from the notifications. You may unsubscribe to further sub-processor notifications by clicking the unsubscribe link contained in each notice.

Recipient category: Software provider, cloud storage provider

Recipient locations: EU and non-EU

Guarantees for transfers to third countries: EU-U.S. Data Privacy Framework or Standard contractual clauses of the EU

Subscription Form:

Sub-processor Notification

Subscribing allows Protiviti to send automated communications related to changes to our sub-processors. You may unsubscribe from these sub-processor alerts at any time via the link provided in the email alerts. If you unsubscribe, you will no longer be notified of changes to our sub-processors.