Subprocessors & International Data Transfers

1. Purpose

This Policy governs transparency and contractual control for third parties that process personal data in support of PrediSmart services and for transfers of personal data across jurisdictions.

2. Subprocessor Governance

PrediSmart evaluates subprocessors according to the nature and risk of the service, requires appropriate confidentiality, security and data protection obligations, and limits processing to contracted purposes.

3. Subprocessor Register

PrediSmart shall maintain a current internal register identifying relevant provider, service purpose, processing role, and principal processing locations. A customer-facing list will be made available where contract or applicable law requires it. The register is operational data and may be updated without rewriting the Terms.

4. International Transfers

Transfers subject to legal restrictions will use an applicable mechanism, which may include adequacy decisions, approved contractual clauses, certifications or frameworks recognized by law, binding rules, contractual mechanisms recognized by the competent authority, or another lawful basis.

5. Customer Instructions

Customer must not configure the Platform to transfer data into a jurisdiction or integration that violates applicable law or the Customer’s own obligations. PrediSmart may restrict a configuration where a material transfer compliance issue is identified.

6. Changes

Where an applicable DPA grants notice or objection rights for new subprocessors, PrediSmart will follow those procedures. An objection must be based on reasonable data protection grounds and does not create a right to require an unsupported service architecture.