Sub-processor Repository

¹ For Customers, where MindTickle Interactive Media Private Limited is a party to the Agreement, this entity is a processor, not a sub-processor.

Note: The duration of processing by these sub-processors will be as per the terms of the Agreement signed with the Customers. Subject to specific approval of corresponding customers, we may use additional sub-processors for processing personal data controlled by the said customer.

Additional information about definitions used in the service applicability

• “Platform” includes Course, Quick Update, Checklist, Instructor-Led Training, Assessment, Missions (Virtual Role-Play), Coaching Session & Competency Assessment (Field Coaching), Spaced Reinforcement
• Conversational Intelligence (Call AI)
• Revenue Operations & Intelligence (RevOps)
• Digital Sales Rooms (DSR)
• Content as a Service (CaaS)

Contractual controls

Mindtickle signs data processing agreements and standard contractual clauses with all of its sub-processors and imposes data protection obligations for protecting customer personal data with similar security standards as committed by Mindtickle to the customers. These data processing agreements are aligned with the global data protection laws such as GDPR, CCPA, CPRA, UK DPA, etc.

We include the following controls in the agreements to ensure the protection of customer personal data –

• Right to audit – to allow an audit of the procedures relevant to customer personal data protection.
• Data deletion – to delete personal data to fulfill data subject or customer requests or upon contract termination
• Confidentiality agreements – to ensure employees and contractors with access to customer personal data have understood the confidential nature of the information and have signed confidentiality agreements
• Training – to educate the employees on security and privacy practices to be followed while handling customer personal data
• Incidents and breaches – to identify the root cause and impact, remediate the incident, and inform Mindtickle of impacted customer personal data relevant to the incident or breach
• Security measures – to mandate technical and organizational security measures through vendor security policy or similar controls required by data protection laws and customer agreements
• Fourth party risk – to impose the same standards of processing and security controls under applicable data protection laws to sub-processors of Mindtickle sub-processors

Onboarding and annual due diligence

In accordance with our supplier security policy, Mindtickle performs mandatory due diligence of all sub-processors through information security, privacy, and legal reviews. Sub-processor due diligence is performed during onboarding and once annually and includes a review of the following –

• SOC 2 Type 2, ISO 27001, NIST, or similar industry-standard security reports
• Compliance with applicable data protection laws and regulations
• Vulnerability assessment and penetration testing reports
• Information security and privacy policy documents
• Privacy notice
• Service level agreements, including uptime commitments, RTO, and RPO
• Business continuity plans and disaster recovery reports
• Supplier due diligence questionnaire

Only the carefully selected suppliers that are approved by security, privacy, and legal teams in the due diligence process are authorized as sub-processors and granted access to customer personal data.

Data sharing and responsibility

Mindtickle engages sub-processors to process personal data only in accordance with the customer agreement and documented instructions through the following –

• Onward data transfer – includes using relevant transfer mechanisms for the transfer of personal data in accordance with the applicable data protection laws.
• Data minimization – sharing only the minimum required personal data that is absolutely necessary to provide services to our customers.
• RoPA – to maintain a detailed record of processing activities, including types, attributes, purposes, and safeguards of personal data shared with our sub-processors, which is reviewed quarterly.
• Risk ownership – Mindtickle takes full responsibility for the security and privacy of the customer data transferred to its sub-processors and will remain liable for any breach of customer personal data caused by any of its sub-processors.

Changes to sub-processors

Mindtickle provides at least 30 days prior notice to our subscribed customers before authorizing any new sub-processors to process customer personal data and provides customers with a window to object to such appointments. Customers can use below subscription form to receive sub-processor change communication.