What does subprocessor mean?
Under GDPR, a subprocessor is any third-party vendor or subcontractor engaged by a data processor to process personal data on behalf of a data controller. Subprocessors are part of a chain, providing essential services such as cloud storage, IT support, or analytics. They must adhere to the same strict data protection obligations as the primary processor.
Bazaarvoice Technology India is considered a subprocessor because it is a separate corporate entity from Bazaarvoice, Inc. (US). While other subsidiaries may be located in countries with EU adequacy agreements, data is stored in cloud servers contracted to the US entity, not the subsidiaries themselves.
What specific data will be processed in India?
User-generated content (UGC), including text and media, will be processed. Additionally, within the Accertify platform, users will have access to email addresses (if collected), IP addresses, and device fingerprints. These signals are necessary to prevent fraud.
Will PII now be flowing to India?
PII will be accessed by Bazaarvoice employees in India using Bazaarvoice-provided computers and a secure VPN. Data is viewed via a browser and is never downloaded or stored locally in India.
Will data be stored in India or just accessed from there?
Data remains permanently at rest in the EU or the US. It is only accessed remotely via VPN within the Accertify platform. No data will be downloaded or stored on-site in India.
Does this affect our agreements (MSA/Contracts)? Do we need to update our DPA?
- MSA: No changes to the Master Services Agreement are required. Standard Contractual Clauses (SCCs) are already in place between Bazaarvoice, Inc. and its Indian subsidiary. All employees are bound by contract terms that meet global privacy and data protection standards.
- DPAs: Vendor lists will be revised to reflect this change. Bazaarvoice typically updates this through our public Subprocessor Vendor List.
- Bespoke agreements: If a client has a bespoke (custom) agreement, Bazaarvoice will wait for the client to reach out to initiate a specific amendment.
Why did Bazaarvoice make this decision?
Our goal is to moderate and authenticate content as close to real-time as possible. While some fraud is obvious enough to be rejected automatically, sophisticated fraud often requires a pattern to emerge. This means content may stay live until a human reviewer can verify the fraud and remove it.
Increasing our time zone coverage allows us to move faster and limit consumer exposure to "bad" content. By adding agents to our existing India office alongside our US team, we achieve 24/7 coverage. Furthermore, India is a global hub for fraud detection; companies like Accertify maintain large offices there, allowing us to hire top-tier talent in the region.
Where can I access the list of other subprocessors collaborating with Bazaarvoice?
You can find the full list here: https://docs.bazaarvoice.com/articles/portal-basics/vendorlist
Is this applicable to all Bazaarvoice features (Ratings & Reviews, Social Commerce, CAS)?
At present, we are authenticating all core content in India. This includes Reviews, Profiles, Questions, Answers, and any attached media. This applies across all service packages.
Is this new scope of subprocessing covered by existing certifications (such as ISO 27001)?
Yes. Bazaarvoice Technology India and associated workflows are covered within the scope of our existing ISO 27001 certification.
