As a customer – and thus as a “Data Controller” according to the European Data Protection Regulation (EU GDPR) – you commission AppNavi as a “Data Processor” with the provision of the IT services described in the service agreement in case of a contract conclusion.
As a Data Processor, Sub-Processors may be engaged for the processing of Personal Data, existing Sub-Processors may be replaced or the scope of their assignments may be adjusted, provided that the Data Controller has approved this in advance.
However, prior approval by you as the Data Controller is not required if
- the Sub-Processor has been carefully selected, in particular taking into account its suitability under data protection law and the appropriateness of the TOM taken by the Sub-Contractor,
- AppNavi as Data Processor and the respective Sub-Processor have entered into an agreement (pursuant to DPA section 9.3), and
- AppNavi as Data Processor informs you as the responsible party about the Sub-Processor at least 30 days in advance in writing or electronically by e-mail and you as the responsible party do not object to the intended assignment of the Sub-Processor to AppNavi in writing or electronically by e-mail for important reasons within 14 days after receipt of this notification.
The following table provides an overview of the Sub-Processors currently engaged.
(Status: January 31, 2021)