Unless otherwise defined herein, capitalized terms will have the meaning given to them in the Contentsquare Master Service Agreement.

The list below outlines Contentsquare’s current Affiliates and third-party sub-processors (“Sub-processors”) who are authorized to process Personal Data on behalf of Customers and in connection with Contentsquare Services.

Note: the applicability of these Sub-processors is dependent upon one or more of the following: the Contentsquare Services purchased and data center location, as further described below.

Contentsquare Group Affiliates

The following Contentsquare Group Affiliates are involved in the provision of Contentsquare Services* to Customers, as further described below:

*Personal Data of Customers using Voice of Customer (“VOC”) are processed by Hotjar Limited and its Sub-processors. For more information, click here.

**Personal Data of Customers using Product Analytics are processed by Heap Inc. and its Sub-processors. For more information, click here.

Note: As Contentsquare provides a ‘follow the sun’ support to its Customers, it is possible that should a Customer require support, depending on the time of day, such support may be provided by an authorized employee from any of the Contentsquare Group Affiliates. Customer Data accessible by such employees are always encrypted and remain stored in the applicable data center region as further described below. For more information, please visit Contentsquare Trust Portal.

Third-party Sub-Processors

Cloud Storage Sub-processors

The following Cloud service providers* are used for the provision of Contentsquare Services to Customers:

* Personal Data of Customers using VOC are stored in Hotjar’s hosting provider AWS-EU-West-1, with limited Personal Data processed by VOC’s User tests capability stored in AWS US-West-2. For more information, click here. Personal Data of Customers using Experience Analytics Free & Experience Analytics Growth (“EA Free & Growth”) are stored in Contentsquare’s hosting provider (AWS-EU-West-1 only) described above.

Note: The default storage location for our Customers’ Personal Data is the following:

• our US-based Customers’ Personal Data is stored in the US,

• our EU-based Customers’ Personal Data is stored in the EU,

• our APJ-based Customers’ Personal Data is stored in the US, except for our Japan-based Customers’ Personal Data which is stored in the EU.

Sub-processors used only for specific support and Professional Services

Note: Contentsquare uses one or more of the Sub-processors listed above only upon Customer’s purchase of specific support and Professional Services (not available for EA Free & Growth).

Other Sub-processors

DEFINITIONS

“Contentsquare Services” means the products and services provided by Contentsquare to Customer under an agreement, including CS Service and Professional Services.

“Corporate Data” means Personal Data that relates to both (a) Customer’s relationship with Contentsquare, including the names or contact information of individuals authorized by Customer to access Customer’s account and billing information of individuals that Customer has associated with its account and (b) Contentsquare prospects, leads and potential Customers, including names and contact information.

SUBSCRIBING TO UPDATES TO THE SUB-PROCESSOR LIST

To subscribe to updates concerning Contentsquare's Sub-processor List, please use this Request Form or send an email to privacy@contentsquare.com with a request to subscribe, and you will be provided with updates on any changes in this list.

REQUESTING MORE INFORMATION ABOUT A SUB-PROCESSOR

For any additional information concerning Contentsquare’s data processing practices or any specific Sub-processors, please send an email to privacy@contentsquare.com identifying the Sub-processor and the requested information.

OBJECTING TO A SUB-PROCESSOR

A Customer (Data Controller) may object to Contentsquare use of a specific Sub-processor in accordance with the terms of the Data Processing Agreement governing the relations between the parties. Such objection may be sent by email to privacy@contentsquare.com (subject line “Sub-processor Objection”) containing the following information:

• Customer Entity Name

• Sub-processor Entity Name

• Grounds for Objection

• Requestor Name

• Requestor Email

Objections must be based on legitimate data protection grounds in accordance with the terms of Contentsquare’s standard Data Processing Agreement.