Subprocessors

1.What every subprocessor agrees to

Before a vendor handles personal data we review its security, and every vendor on this list is bound by a written contract that requires it to:

• process personal data only to provide its service to us;
• keep the data confidential and protect it with security measures appropriate to its risk;
• meet the service provider terms that US state privacy laws require;
• tell us without undue delay if it suffers a security incident that affects the data; and
• return or delete the data when the service ends.

2.Data location

Every subprocessor that stores customer content or account records does so in the United States. Cloudflare serves traffic from its global edge network, where only encrypted requests and request metadata pass through. ATALI ELECTRIC personnel in Faridabad, India, reach production systems by remote access under the controls in our Security Policy and do not copy Customer Data out of the US regions.

3.How we review them

Our security team reviews each subprocessor every year, using its current SOC 2 or ISO 27001 report where one exists, its security documentation and its record of incidents. We replace any vendor that no longer meets our requirements.

4.Notice of changes

We give account owners 30 days' notice by email before adding a subprocessor or changing the purpose or location of an existing one, and we update this page and its date at the same time. A customer may object in writing within the notice period on reasonable data protection grounds, as the Data Processing Addendum describes. To have an additional contact receive notices, email privacy@atalielectric.com.

5.Providers that are not our subprocessors

Services you connect with your own accounts act for you under your own agreements, not for us. They include your identity provider for single sign-on, such as your own Okta tenant, your licenses with CoStar and ATTOM, and your accounts with Yardi Voyager, MRI, RealPage, AppFolio, Entrata, ARGUS Enterprise, DocuSign, SharePoint and Microsoft Excel. County assessor systems and the independent partner firms that handle contingency appeals under their own engagement letters are also outside this list.

6.Questions

This list is current as of the date above. For questions about a subprocessor, or to request a summary of our contractual terms with one, email privacy@atalielectric.com.