Legal

Frequently Asked Questions (FAQ) regarding the addition of new Subprocessors.

What additional entities is LeanIX planning to add as Subprocessors and where are they located?

We intend to add the following SAP Group entities as Subprocessors:

Entity Name Location
SAP Australia Pty Ltd Level 13, 1 Denison Street
North Sydney, NSW 2060
Australia
SAP ASIA Pte Ltd 30 Pasir Panjang Road 
#03-32 Mapletree Business City
Singapore 117440
SAP México S.A. de C.V. Paseo de la Reforma 509 - Piso 20, Col.
Cuauhtémoc,  Alcaldía Cuauhtémoc
C.P. 06500 Ciudad de México
SAP Brasil Ltda. Av. das Nações Unidas, nº 14.171 - Marble Tower - 7º andar 
Vila Almeida - São Paulo 

 

We will also start relying, for the provision of the Services, on the following third parties:

Entity Name Location

ServiceNow Nederland B.V.

Nieuw Amsterdam, Hoekenrode 3, 1102 BR Amsterdam
Gainsight Inc 350 Bay St #100, San Francisco, United States
Tech Mahindra Ltd. Plot No. 6, LGF + 6th floor, Tech Boulevard, Sec-127, Noida- 201301
Snowflake Inc. Bozeman, Suite 3A, 106 East Babcock Street, United States

 

Why are you engaging these new Subprocessors?

As to the SAP entities, please keep in mind that LeanIX has recently become part of the SAP Group. As such, LeanIX wants to leverage and benefit of the expertise of other SAP group entities, for Customer Support purposes. This will improve the level, quality, and availability of our support systems.

As to the third parties, the purpose of their engagement can be described as follows:

Entity Name Location
ServiceNow Nederland B.V. ServiceNow provides a customer support ticketing system that will be used in the context of managing customer’s support requests.
Gainsight Inc. Gainsight provides a customer success software that our Customer Success Managers use in order to support our customers and manage their workflows.
Tech Mahindra Limited TechMahindra provides customer support services.
Snowflake Inc. Snowflake provides data warehousing services.

 

Will the new third parties have access to Personal Data?

Yes, these companies might have access to Personal Data. However, access will be strictly limited to the extent necessary to provide the services. For a detailed description of the data accessed by each Subprocessor, please access https://www.leanix.net/en/legal/list-of-subprocessors .

What are the security measures put in place to ensure the security of the transfer of Personal Data?

The inclusion of these new Subprocessors does not change or impact our security commitments towards you in any way. Please access https://www.leanix.net/en/legal/list-of-subprocessors for a description of the security measures in place for each of these Subprocessors.

How are the new sub-processors contractually bound by the same obligations as existing Subprocessors?

LeanIX has an intra-group Data Processing Agreement in place with the companies of the SAP group (to which all existing and new sub-processor entities are parties), which contractually binds all sub-processor entities to the requirements set out in our existing DPA with you.

For the same purpose, we have also entered into DPAs with all third party Subprocessors.

Please consider that, for confidentiality reasons, these docs cannot be made publicly available. However, to the extent required for customers to perform their internal assessments, LeanIX can provide information on such agreements or make extracts available.

Does LeanIX have Standard Contractual Clauses (“SCCs”) in place with these new sub-processors?

Yes, where the transfer of Personal Data is to a third country and there is no Adequacy decision in place.

Did LeanIX perform a Data Transfer Impact Assessment in connection with the new data transfers?

LeanIX can provide DTFS (Data Transfer Factsheet) upon request. Customer can conclude its own DTIA.

Please contact dataprivacy.subprocessors@leanix.net in that regard.

Do I need to sign a new Data Protection Agreement (“DPA”) or do we need to amend the existing Data Protection Exhibit (DPE) included in my contract with LeanIX?

No, the existing DPE/DPA in place between us already sets out the process for the appointment of additional Subprocessors. We are notifying you of the intended appointment of new sub-processors in accordance with that process.

However, if you wish a written confirmation of the appointment, please contact dataprivacy.subprocessors@leanix.net.

Where can I find a complete, updated list of the subprocessors used by LeanIX?

The complete list of our subprocessors is available here https://www.leanix.net/en/legal/list-of-subprocessors .

At the same link, you can register to receive new updates and information about our subprocessors.

When will the appointment take effect?

The appointment will take effect on 26 April 2024.

Where can I get information in addition to those provided here?

We are here to help! Should you have any more questions, please contact us at dataprivacy.subprocessors@leanix.net