List of Subprocessors

Information about sub-processors utilized by Wingify
Updated on Dec 18, 2019

Wingify Software Pvt Ltd. (“Wingify”) makes use of selected sub-processors to assist in providing the Services as defined in our Terms & Condition (“Terms”) while ensuring privacy and security as described in our Privacy Policy. Terms used on this page but not defined have the meaning set forth in our Terms.

A sub-processor is a third-party data processor retained by Wingify, who has or potentially will have access to Service data (which may contain Personal Information) while providing products or Services on our behalf. Wingify engages different types of sub-processors to perform various functions as explained in the tables below.

Wingify uses a commercially reasonable selection process to evaluate the security, privacy and confidentiality practices of such sub-processors. Additionally, Wingify ensures that its sub-processors satisfy contractual obligations as those required by Wingify (as a Controller or Processor) through requisite Data Protection Addendum (“DPA”).

Wingify provides this list of sub-processors to enable Users and Customers to stay informed about the scope of sub-processes associated with the Services.

1. Infrastructure

Wingify owns or controls access to the infrastructure that Wingify uses to host and process Service data submitted to the Services, and access to Service data is permitted only to legally retained employees. Currently, the Wingify production systems used for hosting Service data for the Services are located in location facilities in the United States and in the infrastructure sub-processors listed below. The following table describes the countries and legal entities engaged by Wingify in the storage of Service data. Wingify also uses additional services provided by these sub-processors to process Service data as needed to provide the Services.

Infrastructure Sub-Processors- Service data Storage and Processing
Entity Name	Purpose	Location
IBM Softlayer	Cloud Hosting Services (SOC 2 Type 2, SOC 3 audited, ISO 27001, 27017, 27018 Certified)	United States
Google Cloud Platform	Cloud Hosting Services (SOC 2 Type 2, SOC 3 audited, ISO 27001, 27017, 27018 Certified)	United States

2. Content Delivery

Wingify may use content delivery networks (“CDNs”) for security purposes as well as to optimize content delivery and speed up data transmission. CDNs do not have access to Service data but are commonly used systems of distributed services that deliver content based on the geographic location, device information, telecommunication provider of the individual accessing the content and the origin of the content provider. Website content served to website visitors and domain name information may be stored with a CDN to expedite transmission, and information transmitted across a CDN may be accessed by that CDN to enable its functions.

Content Delivery Networks to optimize content delivery
CDN Provider	Description of CDN Services	CDN Location
Amazon Web Services	Cloudfront for Library served for legacy VWO Customers.	Global
Cloudflare, Inc.	For VWO Engage.	Global

3. Service Providers

Wingify utilizes third parties to provide specific functionality to facilitate the Services. These providers are the Sub-processors set forth below. In order to provide the relevant functionality, these Sub-processors may have access to Service data. Their use is limited to the indicated Services.

Service Specific Sub-processors
Entity Name	Service Description	Location
Cloudflare, Inc.	Cloudflare, Inc. (“Cloudflare”) provides content distribution, security and DNS services for web traffic transmitted to and from the Services.  OR Secure and manage traffic to the Services, with access to URL interactions and IP addresses.	United States
Salesforce.com, Inc	Customer relationship management (CRM) platform, with access to name, email, role, and affiliation.	United States
Outreach	Sales engagement platform	United States
Marketo	Marketing automation platform and database	United Kingdom
Zendesk, Inc.	Cloud-based Customer Support Services, with access to name, email, role and contact information.	United States
Intercom	Customer messaging platform, with access to name, email, IP address, and integration data.	Ireland
MaxMind	IP lookup (EU-US Privacy Shield Certification)	United States
Clearbit	CRM insight tool. APIHub, Inc. (“Clearbit”) is a third party marketing data engine. The primary service data processed by Clearbit includes lead name, lead email address, lead company name, lead company website, contact name, contact email address, contact company name, and contact company address.	United States
Zapier, Inc.	Interconnection of customer name, email and contact information.	United States
New Relic	Software analytics to monitor application interactions and performance.
Segment	Event tracking for applications for service improvement and support	United States
Sentry.io	Error and bug detection
NS1	Provides DNS services	United States
Slack	Messaging platform for internal notifications	India
2Checkout	Payment gateway	United States
Docusign	Digital Transaction Management	United States

4. Due Diligence

Wingify undertakes to use a commercially reasonable selection process by which it evaluates the security, privacy and confidentiality practices of proposed sub-processors that will or may have access to or otherwise process Service data.

5. Contractual Safeguards

Furthermore, we will not disclose the customer data process in Wingify services to a government agency unless required by law. If law enforcement demands customer data, we will attempt to redirect the agency to request that data directly from the customer. If we are compelled to disclose customer data to law enforcement, we promptly notify the customer and provide a copy of the demand, unless legally prohibited from doing so.

Wingify generally requires its sub-processors to satisfy equivalent obligations required from Wingify (as a Processor) as set forth in Wingify’s Data Protection Addendum (“DPA”), including but not limited to the requirements to:

1. Process Personal Information in accordance with Controller.
2. In connection with their sub-processing activities, use only those personnel who are reliable and subject to a contractually binding obligation to observe data privacy and security, to the extent applicable, pursuant to applicable data protection laws.
3. Provide regular training in security and data protection to personnel to whom they grant access to Personal Information.
4. Implement and maintain appropriate technical and organizational measures (including measures consistent with those to which Wingify is contractually committed to adhere to insofar as they are equally relevant to the sub-processors processing of Personal Information on Wingify’s behalf) and provide an annual certification that evidences compliance with this obligation. In the absence of such certification Wingify reserves the right to audit the sub-processor.
5. Promptly inform Wingify about any actual or potential security breach.
6. Cooperate with Wingify in order to deal with requests from Controllers, Data subjects or data protection authorities, as applicable.

6. Process to Engage New Sub-processors

For all Customers who have executed Wingify’s standard DPA, Wingify will provide notice via this policy of updates to the list of sub-processors that are utilized or which Wingify proposes to utilize to deliver its Services. Wingify undertakes to keep this list updated regularly to enable its customers to stay informed of the scope of sub-processing associated with the VWO Services.

Pursuant to the DPA, a Customer may object in writing to the processing of its Personal Information by a new sub-processor within ten (10) days following the update of this policy and such objection shall describe Customer’s legitimate reason(s) for objection. If the Customer does not object during such a time period, the new sub-processor(s) shall be deemed accepted.

7. Updates

Wingify will maintain this list current by adding the names of new or replacement sub-processors. The date at the top of this Subprocessor indicates when it was last updated.

If you have any questions or concerns regarding our Sub-processor, please send us a detailed message to privacy@vwo.com, and we will try to resolve your concerns.