Subject to the provisions of the “Location and Transfer of Personal Data” clause above,CLESTRA may engage another processor to process Personal Data in the course of carrying out its business (“Subsequent Processor”).
Supplier/Customer expressly authorizes CLESTRA to engage its Affiliates as subsequent Subcontractors. A list of CLESTRA’s Affiliates that are Subsequent Subcontractors is available on CLESTRA’s website. CLESTRA agrees to notify Supplier/Customer within thirty (30) days prior to bringing in a new Affiliate as a subsequent Subcontractor.
Subject to the provisions of the applicable Terms of Service to the contrary, CLESTRA shall not, without the prior consent of Supplier/Customer, engage a Subsequent Subcontractor that is not an Affiliate of CLESTRA (“Third Party Subsequent Subcontractor”).
Clestra shall ensure that the subsequent Subcontractor is, at a minimum, able to fulfil the obligations incumbent upon CLESTRA concerning the processing of Personal Data. To this end, CLESTRA shall enter into an agreement with the Subsequent Subcontractor.
Clestra undertakes not to sell, transfer or give access to third parties without the prior consent of the supplier/client, unless forced to do so by a legitimate reason (legal obligation, fight against fraud or abuse, exercise of rights of defence, etc.)
Notwithstanding the foregoing, CLESTRA is expressly authorized to engage third party providers (such as energy providers, network providers, network interconnection point or data center operators, hardware and software providers, carriers, technical providers, security companies), without the need to inform or obtain prior authorization from the provider/customer, provided that such third party providers do not have access to Personal Data.