Before engaging a third-party provider and assigning it an operating role, Kurtosys performs an exhaustive risk analysis to evaluate suitability – ensuring that it is capable of performing the functions required and complies with applicable security and confidentiality practices. We expect our partners to be have a suitable level of certification to prove this. We further continuously monitor and review the services and actions of third-parties. 

In addition, we enforce strict terms in our agreements with third-party service providers, at a minimum: 

1. Restricting third parties’ and their suppliers’ access to our customer data (to what is necessary to assist them in providing or maintaining services), and prohibiting them from accessing customer data for any other purpose; 
2. Preventing third parties from disclosing information of any kind; 
3. Imposing data protection terms requiring third parties to protect customer data to the standard required by data protection laws; 

In all this, Kurtosys remains responsible for ensuring its compliance with any obligations imposed on it under agreement/s with its Customers, and for any acts or omissions of third parties that may have caused it to breach such obligation/s. 

We encourage our customers to understand how the third parties listed below operate and use data in the context of the products and services we provide, to enable you to judge whether this creates any operational concerns in their data processing.