DPA Annex C — Subprocessors
Version: 2026-10-13-draft
Provider: To be confirmed: legal entity name · Customer: To be confirmed: customer legal name · Approved schedule ID: To be confirmed: approved subprocessor snapshot · Approved version date: To be confirmed: subprocessor snapshot date.
1. Executable approved subprocessor schedule — NOT COMPLETE
No vendor is approved by this unfinished table. Before incorporation into a signed DPA, populate one row for every active third party that processes Customer Personal Data on behalf of SiteAxis, record subprocessor legal entity and actual service/region, and document the executed terms and Customer notice mechanism. Remove all unapproved candidates and blank rows.
| Legal entity / trade name | Service purpose | Data classes | Storage + access regions | Subprocessor DPA/contract version | Transfer instrument | Status / effective date |
|---|---|---|---|---|---|---|
| To be confirmed: subprocessor row 1 | To be confirmed: subprocessor purpose 1 | To be confirmed: subprocessor data classes 1 | To be confirmed: subprocessor regions 1 | To be confirmed: subprocessor contract 1 | To be confirmed: subprocessor transfer 1 | To be confirmed: subprocessor status 1 |
| To be confirmed: subprocessor row 2 | To be confirmed: subprocessor purpose 2 | To be confirmed: subprocessor data classes 2 | To be confirmed: subprocessor regions 2 | To be confirmed: subprocessor contract 2 | To be confirmed: subprocessor transfer 2 | To be confirmed: subprocessor status 2 |
| To be confirmed: subprocessor row 3 | To be confirmed: subprocessor purpose 3 | To be confirmed: subprocessor data classes 3 | To be confirmed: subprocessor regions 3 | To be confirmed: subprocessor contract 3 | To be confirmed: subprocessor transfer 3 | To be confirmed: subprocessor status 3 |
| Additional entries | To be confirmed: full verified subprocessor table | — | — | — | — | — |
2. Change notice and customer objection
SiteAxis will maintain a dated, version-controlled list and notify Customer of a proposed new/replacement Subprocessor To be confirmed: subprocessor notice days days in advance using To be confirmed: subprocessor notice method to the designated address. Customer may object within To be confirmed: subprocessor objection days days on reasonable documented data-protection grounds. The Parties will attempt mitigation or an alternative. If material concerns cannot be reasonably addressed, the remedy is To be confirmed: subprocessor objection remedy under the DPA. Emergency replacements are subject to the DPA's accelerated notice restriction and mandatory law.
3. Data transfer record for each approved vendor
For each provider, record:
- Actual processing categories and sensitive safety/incident content exposure.
- Primary and backup locations, global/support access, onward subprocessors and subprocessors' authorized scope.
- Contract/DPA identifier and URL/file hash; data transfer safeguards/impact assessment; retention and deletion options.
- Required advance notice and contact, vendor incident reporting rules, escalation channel.
- Last runtime/configuration verification date and reviewer names.
Business owner: To be confirmed: subprocessor register owner · Last reviewed: To be confirmed: subprocessor facts last verified · Vendor contract review: To be confirmed: subprocessor security review.
Questions before controlled trial use?
Contact SiteAxis before sharing production customer data, provider secrets, or sensitive screenshots.