Certyze Public Subprocessor List

1. About This Document

This document is the public subprocessor list for Certyze, a conformity assessment body management platform operated by Thinkdata Labs LLP (LLPIN AAI-9081, GSTIN 06AAMFT4128J2ZW), with its registered office at 176 First Floor, Sector-10, Panchkula, Haryana 134112, India.

Publication Date: 19 October 2026.

This list identifies each Subprocessor engaged by Thinkdata Labs LLP to process Personal Data on behalf of Customers in connection with the Certyze platform. For each Subprocessor, the list specifies the processing purpose, categories of data processed, principal processing locations, and applicable transfer safeguards.

Customers should read this list together with their data processing agreement or equivalent contractual terms governing the Certyze service. Where a conflict exists between this list and the terms of a Customer’s Data Processing Addendum, the Data Processing Addendum prevails. Thinkdata Labs LLP will maintain and update this list in accordance with Section 7 (Updates and Version History).

2. Definitions

The following terms, when capitalized in this document, have the meanings set out below.

CAB Production Data and Business and Contact Metadata are subject to different residency and processing location considerations as described in Section 3 of this document.

3. Data Residency Overview

3.1 The CAB Production Data database and its backups are configured to reside within the AWS ap-south-1 (Mumbai, India) region. This configuration is maintained through Amazon RDS and associated AWS storage services as described in Section 4.

3.2 Processing locations for other categories of Personal Data differ from the CAB Production Data residency described above. The following processing activities may involve transfers of Personal Data outside India:

3.3 Accordingly, not all Certyze-related Personal Data remains in India. Customers should review the Subprocessor List in Section 4 and the Transfer Safeguards in Section 5 for further detail on each Subprocessor’s processing locations and applicable protections.

4. Subprocessor List

The following table sets out each Subprocessor currently engaged by Certyze as of 19 October 2026.

5. Transfer Safeguards

5.1 Where Processing of Personal Data by a Subprocessor occurs outside India, Thinkdata Labs LLP applies the following safeguards:

5.2 The specific transfer mechanism applicable to each Subprocessor is governed by that Subprocessor’s own contractual terms, public compliance documentation, and the regulatory requirements of the jurisdictions involved. Thinkdata Labs LLP does not warrant or control the transfer mechanisms maintained by third-party Subprocessors beyond the contractual obligations it has secured.

6. Customer Notification and Objection Process

6.1 Notification of Changes. Certyze will notify Customers at least thirty (30) calendar days before any new Subprocessor begins Processing Personal Data, or before a material change to an existing Subprocessor’s scope of Processing. Notification will be provided by email to the address associated with the Customer’s Certyze account and by updating this Subprocessor list.

6.2 Objection Process. A Customer may raise a reasonable, written objection to a proposed Subprocessor within fifteen (15) calendar days of receiving the notification described in Section 6.1. Objections must be sent to legal@thinkdatalabs.com and must state specific grounds related to data protection concerns.

6.3 Resolution. Upon receipt of a timely objection, Certyze will engage in good-faith discussions with the objecting Customer to address the concern, which may include proposing a commercially reasonable alternative arrangement. Certyze will use reasonable efforts to respond within fifteen (15) calendar days.

6.4 Termination Right. If the parties are unable to resolve the objection within thirty (30) calendar days of Certyze’s receipt of the objection, the Customer may terminate the affected services by providing written notice, without penalty, effective upon the date the new Subprocessor commences Processing. Any prepaid fees for the terminated services covering the period after the effective termination date will be refunded on a pro rata basis.

7. Updates and Version History

7.1 This Subprocessor List is published at certyze.com/legal/subprocessors and may be updated from time to time. Thinkdata Labs LLP will review this list at least once every calendar quarter and will publish a revised version whenever a Subprocessor is added, removed, or materially changed.

7.2 Each revised version will bear a new publication date and will be accompanied by a brief description of the change in the Version History table below. Customers are encouraged to review this list periodically. The notification and objection process described in Section 6 applies to any material update.

8. Contact Information

For any inquiries, concerns, or requests relating to this Subprocessor List, including questions about data Processing, transfer safeguards, or the Customer notification and objection process, please contact Thinkdata Labs LLP using the details below.

Thinkdata Labs LLP will endeavour to acknowledge all written inquiries within a reasonable period of receipt. Communications should reference this Subprocessor List and include sufficient detail to allow prompt identification and resolution of the matter raised.