The Willis Towers Watson contracting entity detailed in the Agreement is the Processor under GDPR. The list below identifies the sub-processors supporting the processing activity.
Data Transfer Protection Principles
For all personal data transfers within the WTW Group, we have an intercompany data transfer agreement in place which includes Standard Contractual Clauses.
We also require our affiliates to notify us if they receive a production request so that the request can be prevented or limited on the basis that any such request relates to confidential information which we are required to ensure remains confidential.
In accordance with the Schrems II ruling requirements, where we rely on the European Standard Contractual Clauses to protect transfers of EEA personal data outside the EEA, we also have technical and organizational measures in place across our entire Group which include encryption whilst in transit and at rest, data minimization, robust access controls and robust retention periods.
Subject Matter, Nature and Purpose. The processing consists of and is carried out for the following purposes:
|
PROCESSING ACTIVITY |
SUB-PROCESSORS |
DATA TRANSFER PROTECTION PRINCIPLES |
|
Cloud service provider used to facilitate purchase of WTW products |
Commerce.com US, Inc. |
This processing will only take place if HR Trove is selected for the purpose of purchasing or downloading a WTW product/service online. Commerce sub-processors can be viewed at https://www.commerce.com/privacy/data-processors/ |
|
Cloud service provider used for sending of marketing emails |
Hubspot Inc |
This processing will only take place if opted in to HR Trove marketing emails. Hubspot sub-processors can be viewed at https://legal.hubspot.com/sub-processors-page |