Notification of New Sub-Processors FAQ - February 20231. Does this change the location of the data centre pair for my customer instance? No, this update does not impact the location of your data centre pair, which remains as previously agreed. Your internal ServiceNow administrator can confirm which data centre pair your customer instance resides in. ServiceNow only hosts customer data in the region the customer has specified. However, as ServiceNow is a global company, we have locations across the world. ServiceNow relies on ServiceNow affiliates to offer customer support using a Follow-The-Sun model. The ServiceNow affiliates (as sub-processors) provide vital customer service to our customers. All processing of customer data is always in strict accordance with our Data Security Guide - access to customer data occurs on a case-by-case basis and is strictly controlled, with activity being logged and monitored. 2. What if ServiceNow has agreed to keep my data in a particular location? This update applies to customers of ServiceNow’s general subscription services only. To the extent that you are availing of a regulated market or region-specific support offerings or where you have received contractual commitments that your data will be kept in a particular location only, then your service will not be impacted by this update. We will continue to only process your data in accordance with our existing contractual obligations. By way of example, if you are a customer availing of the ServiceNow Protected Platform for the European Union or ServiceNow’s Global Cloud Community or National Security Cloud offerings, then this update does not change ServiceNow’s existing commitments to you regarding where we process data. 3. Have you appointed any new third-party sub-processors? No. All of the sub-processors being appointed are ServiceNow group entities. They are as follows: ServiceNow Poland sp.z.o.o (Poland)ServiceNow Spain SL (Spain)ServiceNow Sweden AB (Sweden)Service-Now.com GmbH (Germany)ServiceNow GmbH (Austria)ServiceNow Belgium BV (Belgium)ServiceNow Denmark ApS (Denmark)ServiceNow Finland Oy (Finland)ServiceNow France SAS (France)ServiceNow Italy S.r.l (Italy)ServiceNow Norway AS (Norway)ServiceNow Switzerland GmbH (Switzerland)Service Now A.B Israel 2012 Ltd. (Israel)ServiceNow Canada Inc (Canada) 4. Why are you appointing new sub-processors now? This change is being made so that we can continue to grow as a business, manage capacity, and ensure that our global support continues to meet the requirements of customers. 5. Do you have Standard Contractual Clauses (“SCCs”) in place with these new sub-processors? No, that is not required. These sub-processors are all either entities which are directly subject to the GDPR and based in the EEA (e.g. entities in Poland, Spain, Sweden, Germany, Austria, Belgium, Denmark, Finland, France, Italy and Norway) or are located in countries which benefit from an ‘adequacy decision’ from the EU Commission (e.g. entities in Switzerland, Israel and Canada). For that reason, it is not necessary to implement SCCs for data transfers to those entities. The appointment of these new sub-processors does not create any new requirements with regard to international data transfers. 6. Do I need to sign a new Data Protection Agreement (“DPA”) or do we need to amend the existing DPA? No, the existing DPA in place between us already sets out the process for the appointment of additional sub-processors. We are notifying you of the intended appointment of new sub-processors in accordance with that process. 7. Where can I see a list of the sub-processors you have in place? The complete list of our sub-processors is available here. This list includes our existing sub-processors plus the new sub-processors (who are ServiceNow group entities) being appointed as part of this update. 8. Will this update to the sub-processors change the service I receive? No, you will continue to receive the agreed levels of service and it won’t impact how we deliver the service on your end. We will continue to provide the high level of service reflected in your ServiceNow ordering agreement. 9. Will the new sub-processors treat the data differently? No, all of our ServiceNow sub-processors treat and protect customer data in the same way. Each new sub-processor will be subject to the same contractual and legal obligations as the existing sub-processors. 10. How are the new sub-processors contractually bound by the same obligations as existing sub-processors? ServiceNow has an intra-group Data Processing and Transfer Agreement in place (to which all existing and new sub-processor entities are parties), which contractually binds all sub-processor entities to the requirements set out in our existing DPA with you. 11. When will this appointment take effect? This update will take effect on April 11, 2023, sixty (60) days from the date of the notice. 12. Where can I get more information about this change in sub-processors? We are here to help. If you have any questions, please comment directly on your open Communication (COMM) record (which is the notification we have sent you). If you cannot respond on that COMM record, please open a support case using the online Technical Support system in the Now Support (HI) portal. This case should include a subject title that clearly references “Sub-processor update” to ensure that your query is promptly directed to the correct team. 13. Where can I get more information about your privacy compliance? If you have more general questions, then you’re in luck - we have introduced several tools and created lots of materials to help our customers understand our policies and procedures and to self-serve where you have queries. We make the following resources available: Our Trust site: https://www.servicenow.com/company/trust.htmlThe enhanced Compliance Operations Readiness Evidence resource (CORE*) on Now Support contains formal privacy, security, and compliance related documents and evidence such as our policies, procedures, and third-party attestations, certifications, transfer impact assessment, government request positions and reports, explanatory whitepapers and more detailed responses to commonly asked questions.