Databricks Subprocessors

Databricks Subprocessors

Databricks, Inc. (“Databricks”) uses certain Subprocessors (including members of the Databricks Group and third parties, as listed below) and subcontractors to assist it in providing the Subscription Services as described in the Databricks Terms of Service or other written agreement you have with Databricks (“Agreement”). Capitalized terms used herein shall have the same meaning as defined in the Agreement.

Subscribe to an RSS feed to be notified when we add new Databricks Subprocessors (note: for the RSS feed option you will need to cut and paste the “Subscribe to an RSS feed” URL into an RSS Feed Reader to monitor updates).

What is a Subprocessor:

A Subprocessor is a third party data processor utilized by Databricks in the delivery of its Subscription Services, including entities from within the Databricks Group, who has or potentially will have access to or will process Customer Data (including Personal Data) or who may receive Personal Data from Subscriber as part of Databricks providing the Subscription Services. Databricks engages different types of Subprocessors to perform various functions as explained in the tables below. Note that third party Subscription Services linked to within the Subscription Services (e.g., Github) are not considered Databricks Subprocessor. Such Subscription Services are provided subject to the terms of service and privacy policies applicable to such Subscription Services. Databricks refers to third parties that do not have access to or process Customer Data but who are otherwise used to provide the Subscription Services as “subcontractors” and not Subprocessors.

Contractual Safeguards:

Databricks requires its Subprocessors to satisfy equivalent obligations as those required from Databricks (as a Data Processor) as set forth in Databricks’ Data Processing Agreement (“DPA”), including but not limited to the requirements to:

• process Personal Data in accordance with data controller’s (i.e. Subscriber’s) documented instructions (as communicated in writing to the relevant Subprocessor by Databricks);
• implement and maintain appropriate technical and organizational measures (including measures consistent with those to which Databricks is contractually committed to adhere insofar as they are equally relevant to the Subprocessor’s processing of Personal Data on Databricks’ behalf) and provide an annual certification that evidences compliance with this obligation. In the absence of such certification Databricks reserves the right to audit the Subprocessor; and
• promptly inform Databricks about any security breach.

This policy does not give Subscribers any additional rights or remedies and should not be construed as a binding agreement. The information herein is only provided to illustrate Databricks’ engagement process for Subprocessors as well as to provide the actual list of third party Subprocessors used by Databricks as of the date of this policy (which Databricks may use in the delivery and support of the Subscription Services).

If you are a Databricks Subscriber and wish to enter into our DPA, please email us at privacy@databricks.com.

Process to Engage New Subprocessors:

Prior to the addition or change of any Subprocessors described in this policy, Databricks shall provide notice to Subscriber by updating this website not less than 30 days prior to the date on which the Subprocessor shall commence processing Personal Data. It is Subscriber’s responsibility to check this website for changes. Pursuant to the DPA, a Subscriber can object in writing to the processing of its Personal Data by a new Subprocessor within ten (10) days after updating of this policy and shall describe its legitimate reasons to object. If Subscriber does not object during such time period the new Subprocessor(s) shall be deemed accepted.

If a Subscriber objects to the use of a Subprocessor pursuant to the process provided under the DPA, Databricks shall have the right to cure the objection through one of the following options (to be selected at Databricks’ sole discretion):

(a) Databricks will cease to use the Subprocessor with regard to Subscriber’s Personal Data, which may result in new Subscription Services features enabled by the Subprocessor not being available to Subscriber ; or

(b) Databricks will work with Subscriber to address Subscriber’s reasonable objections and thereafter proceed to use the Subprocessor to perform such processing.

Termination rights, as applicable and agreed, are set forth exclusively in the DPA.

The following is an up-to-date list (as of the date of this policy) of the names and locations of Databricks Subprocessors (including members of the Databricks Group and third parties):

Infrastructure Subprocessors

Databricks utilizes certain cloud service providers to host the Platform Services, to provide Databricks with certain services related to the provisioning of the Platform Services, including storing certain data relating to the Platform Services. Additionally, the Subscription Platform Services require Subscriber to have its own account with the Cloud Service Provider listed here. The Platform Services are provided by means of a split architecture where Subscriber’s Customer Data stays primarily within Subscriber’s own Cloud Service Provider account (e.g., within an S3 bucket controlled by Subscriber). Note: Azure Databricks is provided directly by Microsoft. Additional information for Azure Databricks can be found here.

Service-specific Subprocessors

Databricks works with certain third parties to provide specific functionality within the Subscription Services. These providers are the Subprocessors set forth below. In order to provide the relevant functionality these Subprocessors may access Customer Data.

Databricks Group Subprocessors

The following entities are members of the Databricks Group. Accordingly, they function as Subprocessors to provide the Subscription Services.

Subcontractors

As explained above, Databricks also uses certain “subcontractors” to assist in the operations necessary to provide the Subscription Services. The following is a list (as of the date of this policy) of the names and locations of material third-party subcontractors. Subcontractors do not have access to Customer Data, except as stated below.

Last Modified: July 9, 2021