Authorized Service Providers

1. Introduction

Renvia relies on a carefully selected set of third-party service providers ("Service Providers") to support the secure, reliable, and efficient operation of our platform. These Service Providers assist us in areas such as infrastructure hosting, security, and payment processing. We engage only those providers who meet our strict requirements for data protection, confidentiality, and compliance with applicable privacy laws, including the General Data Protection Regulation (GDPR).

2. What Is a Service Provider?

For the purposes of the GDPR and related data protection laws, Service Providers may act as "subprocessors"—that is, third parties engaged by Renvia to process personal data on behalf of our customers ("Customer Data"). These providers are authorized to process Customer Data strictly as necessary to deliver their contracted services to Renvia, and always subject to Renvia's instructions and data processing agreements. Service Providers are prohibited from using Customer Data for their own purposes.

3. Authorized Service Providers

The list above reflects Renvia's current core Service Providers. Additional providers may be engaged for ancillary or optional features, and will be disclosed in accordance with applicable data processing agreements.

4. Data Protection Requirements

Renvia requires all Service Providers to enter into written agreements containing robust data protection terms. These contracts obligate each provider to:

• Process Customer Data solely on documented instructions from Renvia and only for the limited purpose of delivering contracted services.
• Maintain strict confidentiality of all Customer Data and ensure that personnel are subject to appropriate confidentiality obligations.
• Implement appropriate technical and organizational security measures to protect Customer Data against unauthorized access, loss, or disclosure.
• Assist Renvia in meeting GDPR obligations, including data subject rights and incident notification requirements, as applicable.
• Notify Renvia promptly of any actual or suspected data breach involving Customer Data.
• Submit to audits and provide information necessary to demonstrate compliance with GDPR and contractual requirements.

5. International Transfers

Where Service Providers process Customer Data outside the European Economic Area ("EEA"), Renvia ensures that such transfers are conducted in compliance with applicable data protection laws. This may include:

• Relying on adequacy decisions by the European Commission for countries deemed to provide an adequate level of data protection.
• Implementing Standard Contractual Clauses ("SCCs") or other approved transfer mechanisms to safeguard Customer Data.
• Applying supplementary technical and organizational safeguards where required to ensure an essentially equivalent level of protection for Customer Data.

Renvia regularly reviews its Service Providers and cross-border transfer arrangements to ensure ongoing GDPR compliance.

6. Changes to Service Providers

Renvia may update its list of authorized Service Providers from time to time to reflect changes in our operations, technology, or business needs. Where required by applicable law or the terms of our Data Processing Agreement ("DPA"), we will provide advance notice of material changes to our Service Providers. Customers may object to the appointment of a new subprocessor in accordance with the terms and procedures set out in the DPA.

7. Related Documents

• Terms of Service
• Privacy Policy
• Data Processing Agreement (DPA)

8. Contact

For any questions, concerns, or requests regarding Renvia's Service Providers or data processing practices, please contact us at:

• privacy@renvia.app
• support@renvia.app