ZipZy® Subprocessor List Policy

A subprocessor is a third-party organisation that processes Customer Personal Data on our behalf in order to provide part of the ZipZy® Services.

Not every supplier or vendor is a subprocessor. A provider becomes a subprocessor only when it actually processes Customer Personal Data on our behalf.

For example, software used solely for our own accounting or internal business operations does not become a subprocessor merely because we purchase or use it.

Building every component of a modern cloud platform internally is not always practical or beneficial. We engage specialist providers where they deliver capabilities that meet higher standards of security, reliability, scalability, or performance.

Examples include infrastructure services, payment processing, email delivery, network protection, AI inference, security monitoring, and similar specialised functions.

We minimise the number of subprocessors we use, provide only the minimum data necessary for each provider's function, and prefer providers operating infrastructure within India whenever practical.

Before engaging any subprocessor that will process Customer Personal Data, we conduct a documented assessment covering the following areas:

• Security controls, encryption, identity management, certifications, and organisational safeguards.
• Compliance with the Digital Personal Data Protection Act (DPDP Act) and, where relevant, GDPR obligations.
• Location of data storage and processing, with preference given to providers operating within India.
• Availability of Standard Contractual Clauses or equivalent transfer safeguards where processing occurs outside India.
• Public security incident history and the provider's response to previous incidents.
• Acceptance of our contractual data protection requirements without material weakening.
• Operational resilience, financial stability, service availability, and support capability.
• Whether the provider genuinely requires access to Customer Personal Data and whether that access can be minimised.
• Practicality of replacing the provider should circumstances require migration.

Providers unwilling to meet our contractual data protection requirements are not engaged regardless of technical capability.

Every subprocessor is engaged under a written agreement imposing obligations that are no less protective than those contained in our Data Processing Addendum.

• Processing Customer Personal Data only on our documented instructions.
• Confidentiality obligations binding on personnel handling Customer Personal Data.
• Appropriate technical and organisational security measures.
• Restrictions on appointing additional subprocessors without appropriate notice.
• Assistance with Customer requests relating to privacy and data protection.
• Prompt notification of security incidents affecting Customer Personal Data.
• Deletion or return of Customer Personal Data when the relationship ends.
• Cooperation with audits and compliance verification where applicable.
• Implementation of Standard Contractual Clauses or equivalent safeguards where international transfers occur.
• For AI providers, contractual prohibitions on training or improving AI models using Customer Data.

We engage subprocessors only for defined operational purposes. The categories below describe the types of providers we may use and the functions they perform.

5.1 Infrastructure and Cloud Providers. Compute infrastructure, object storage, Data Backup storage, database hosting, and supporting cloud services. Primary production systems remain self-managed within India wherever practical.

5.2 Network Security and Content Delivery. Providers delivering DDoS protection, Web Application Firewall (WAF), DNS, TLS termination, bot protection, and edge caching. These providers necessarily process request metadata such as IP address, browser information, and requested URLs while protecting the Services.

5.3 Payment Providers. Providers responsible for subscription billing, payment processing, refunds, mandates, and invoicing. Payment credentials remain under the payment provider's control and are not stored by ZipZy®.

5.4 Email and Communication Providers. Providers responsible for transactional email, notifications, marketing communications (where permitted), and messaging services.

5.5 Analytics and Product Telemetry. Providers used for aggregated analytics, product usage measurement, and operational insights. Where possible, IP addresses are truncated or hashed.

5.6 Error and Performance Monitoring. Services capturing application errors, performance metrics, crash reports, and operational diagnostics while minimising personal data collection.

5.7 Customer Support Providers. Providers supporting helpdesk operations, support tickets, and customer communication.

5.8 AI Providers. AI model providers used solely for inference supporting AI Features. Customer Inputs and Outputs are processed only to generate responses and are contractually prohibited from being used to train foundation models.

5.9 Security Providers. Malware detection, phishing analysis, URL reputation services, and other security tooling used to protect Customers and the platform.

5.10 Identity Providers. Third-party authentication providers used only when Customers choose federated sign-in methods.

6.1 Primary Storage. Customer Personal Data is primarily stored on our own infrastructure located within India.

6.2 Backup Storage. Data Backups are maintained within the AWS Asia Pacific (Mumbai) region.

6.3 International Processing. Certain categories of providers—including network protection, monitoring, customer support tooling, and AI inference—may process limited data outside India where operationally necessary. Where this occurs, we implement safeguards including Standard Contractual Clauses or equivalent contractual protections together with transfer impact assessments.

6.4 Enterprise Requests. Enterprise Customers with specific residency or localisation requirements may request written commitments by contacting privacy@zipzy.in.

The following table represents the current categories of subprocessors engaged in providing the Services.

7.1 Dynamic Providers. Certain provider categories may change over time. Customers will be notified before newly appointed named subprocessors begin processing Customer Personal Data in accordance with Section 8 of this Policy.

7.2 Version History. Versioned copies of this subprocessor list are available upon request for procurement, audit, or compliance purposes.

7.3 Additional Information. Customers may request the currently appointed provider for any listed category by contacting privacy@zipzy.in.

We may appoint new subprocessors or replace existing subprocessors as our Services evolve. Where Customer Personal Data will be processed by a new subprocessor, we provide advance notice whenever reasonably practicable.

8.1 Notice Period. Customers are normally notified at least 30 days before a new or replacement subprocessor begins processing Customer Personal Data.

8.2 Notification Methods. Notifications may be provided by email to Workspace Administrators or security contacts, together with updates to this Policy.

8.3 Notification Contents. Notices generally identify the subprocessor, its processing purpose, categories of personal data involved, processing location, transfer safeguards where applicable, and the planned commencement date.

8.4 Customer Responsibilities. Customers are responsible for maintaining accurate administrative and security contact information so that notifications can be delivered successfully.

8.5 Emergency Appointments. Where immediate engagement of a subprocessor is necessary to respond to a security incident, service outage, or operational emergency, we may appoint the provider before advance notice and notify Customers as soon as reasonably practicable thereafter.

8.6 Provider Removal. Removal of an existing subprocessor generally does not require advance notice, although this Policy will be updated to reflect the change.

Customers may object to the appointment of a newly introduced subprocessor where they have reasonable data protection concerns.

9.1 Right to Object. Objections should be submitted within 15 days after notification by contacting privacy@zipzy.in together with a detailed explanation of the concern.

9.2 Good-Faith Review. We will evaluate the objection and determine whether additional safeguards, technical measures, contractual protections, or an alternative provider can reasonably address the concern.

9.3 No Reasonable Resolution. If the concern cannot reasonably be resolved, eligible Customers may terminate the affected subscription before the new subprocessor begins processing Customer Personal Data, subject to the applicable agreement.

9.4 Scope. This objection process applies only to newly appointed subprocessors. Existing subprocessors engaged before a Customer entered into the Agreement are accepted as part of that Agreement.

Subprocessors remain subject to ongoing oversight throughout the duration of our relationship with them.

• Periodic reviews of security controls, certifications, and organisational safeguards.
• Assessment following publicly reported security incidents or material operational changes.
• Verification that contractual obligations remain current and enforceable.
• Review of international transfer mechanisms where cross-border processing occurs.
• Confirmation that the provider continues to receive only the minimum Customer Personal Data necessary for its function.

Where a subprocessor experiences a security incident affecting Customer Personal Data, we manage that incident under the procedures described in the Data Processing Addendum and notify affected Customers where required.

When a subprocessor relationship ends, we implement a controlled offboarding process designed to protect Customer Personal Data.

• Terminate the provider's authority to process Customer Personal Data.
• Require deletion or return of Customer Personal Data in accordance with contractual obligations.
• Obtain confirmation that deletion or return has been completed where appropriate.
• Revoke credentials, API access, and system integrations.
• Update this Policy where necessary to reflect the change.
• Notify affected Customers where offboarding results from a security or compliance concern.

Pranava Company Group remains fully responsible for the acts and omissions of subprocessors relating to Customer Personal Data, to the extent required under applicable agreements and law.

Appointment of a subprocessor does not reduce, transfer, or limit our obligations under the Data Processing Addendum, the Privacy Policy, or the Terms of Service.

Not every third party connected with the Services acts as a subprocessor. The following are not considered ZipZy® subprocessors:

• 13.1 Customer Integrations. Third-party applications or services that you choose to connect to your Workspace receive data at your direction under your own agreement with that provider.
• 13.2 Destination Websites. Websites, applications, or services that users visit after clicking a ZipZy® link or scanning a QR code operate independently and are not our subprocessors.
• 13.3 Customer Vendors. Providers engaged directly by Customers remain under the Customer's control and responsibility rather than ours.
• 13.4 Internal Business Vendors. Providers supporting our accounting, payroll, legal, finance, or internal collaboration activities that process only Pranava Company Group's own corporate information are not subprocessors because they do not process Customer Personal Data.
• 13.5 API Developers. Applications developed using the ZipZy® API operate independently under the developer's own legal relationship with Customers and are governed by the API Terms.

Privacy Team
Prince Tyagi
privacy@zipzy.in

Postal Address
Pranava Company Group (ZipZy®)
62, Mandola, Loni
Ghaziabad, Uttar Pradesh 201102
Bharat (India)

Related Policies: Data Processing Addendum • Privacy Policy • Security Policy • AI Usage Policy • Compliance Statement.

We review this Policy regularly to ensure it accurately reflects the subprocessors engaged in delivering the ZipZy® Services and our ongoing commitment to protecting Customer Personal Data.