Descriptions of Personal Data Processing

To provide various aspects of its products and services, Moody’s may process personal data on behalf of its clients as a “data processor” or “service provider” (or equivalent under applicable law). The subject matter, nature and purpose of the processing is to provide the products and services in the client contract. The duration of the processing is until Moody’s returns or deletes the personal data in accordance with the client contract. The categories of personal data and individuals, third-party service providers, and processing locations are described below.

Cloud hosting locations may be different than the defaults stated below, if specifically selected by client and as per the individual client contract. Moody’s has entered into: (i) EU standard contractual clauses, and (ii) similar data transfer agreements under local applicable law (including the UK), both intragroup and with third-party sub-processors, where applicable.

Product/ Service	Categories of Individuals Individuals* whose personal data are (i) uploaded/saved by client, and/or (ii) matched on behalf of client Likely to include:	Categories of Personal Data Personal data (i) uploaded/saved by client, and/or (ii) matched on behalf of client Likely to include:	Sub-Processors & Location
ABS Suite Plus / ABS Lender / ABS ESG	Client’s customers	Borrower information (e.g., address, account number, borrower type), loan information (e.g., loan type, asset details)	Amazon Web Services, Inc. - cloud hosting ABS ESG - US hosting only ABS Suite Plus / ABS Lender - EMEA clients: Dublin, Ireland Americas clients: Oregon or Virginia, USA APAC clients: Sydney, Australia Aspire Systems, Inc., USA - technical support, systems implementation, quality assurance & development Cledar Sp.zo.o., Poland - technical support DataArt Solutions Datamatics Global Services Limited, India - technical support, systems implementation, quality assurance & development ICRA Analytics Ltd, India - technical support, systems implementation, quality assurance & development I-Peritus Solutions & Services Private Limited, India - technical support, systems implementation, quality assurance & development SMIL Group LLC, USA - technical support, systems implementation, quality assurance & development Cloudflare, Inc., USA – managed web application firewall
Accelerate Farm Profits	Client’s customers	Identifiers (e.g., name, location), financial information (e.g., income, expenses), business information (e.g., production, crops, livestock)	Amazon Web Services, Inc. - cloud hosting USA Intelinair – field-level data matching Tata Consultancy Services - development
AI & Client GRID Review	Client’s customers & suppliers	Identifiers (e.g., name, address, date of birth), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities)	Amazon Web Services, Inc. - cloud hosting EMEA clients: Dublin, Ireland (primary); Frankfurt, Germany (failover) Americas clients: Virginia, USA (primary); Oregon, USA (failover) On client request: Mumbai, India WNS Global Services Private Limited, India – customer support Databricks, Inc., USA, – data analytics Cloudflare, Inc., USA – managed web application firewall
Analyst GRID Review	Client’s customers & suppliers	Identifiers (e.g., name, address, date of birth), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities)	Amazon Web Services, Inc. - cloud hosting EMEA clients: Dublin, Ireland (primary); Frankfurt, Germany (failover) Americas clients: Virginia, USA (primary); Oregon, USA (failover) On client request: Mumbai, India WNS Global Services Private Limited, India, Romania – customer support, analyst review ServicEngine Ltd, Bangladesh – analyst review Databricks, Inc., USA, – data analytics Cloudflare, Inc., USA – managed web application firewall
Banking Cloud; RiskConfidence Fit+	Client’s customers	Identifiers (e.g., name, contact details, date of birth)	Amazon Web Services, Inc. - cloud hosting EMEA clients: Dublin, Ireland APAC clients: Sydney, Australia / Singapore Cloudflare, Inc., USA – managed web application firewall
Compliance Catalyst	Client’s customers & suppliers	Identifiers (e.g., name, business contact details), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities)	Amazon Web Services, Inc. - cloud hosting EMEA clients: Dublin, Ireland (primary); Frankfurt, Germany (failover) Americas clients: Virginia, USA (primary); Oregon, USA (failover) On client request: Mumbai, India WNS Global Services Private Limited, India, Romania – customer support Cloudflare, Inc., USA – managed web application firewall
Credit Catalyst	Client’s customers & suppliers	Identifiers (e.g., name, business contact details), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities)	Amazon Web Services, Inc. - cloud hosting Frankfurt, Germany Cloudflare, Inc., USA – managed web application firewall
CreditLens (CRE/C&I Modules)	Client’s customers	Borrower information (e.g., name, contact details, date of birth), loan details	Amazon Web Services, Inc. - cloud hosting EMEA clients: Dublin, Ireland Americas clients: Oregon, USA APAC clients: Sydney, Australia, Singapore Microsoft OpenAI Azure US Central – only applicable for GenAI Credit Memo functionality
CreditLens Front Office CreditLens Automation CreditLens Back Office	Client’s customers	Borrower information (e.g., name, contact details, date of birth), loan details	Amazon Web Services, Inc. - cloud hosting EMEA clients: Dublin, Ireland Americas clients: Oregon, USA APAC clients: Sydney, Australia, Singapore Numerated Growth Technologies, Inc., USA, digital loan origination system
CreditLens Monitor	Client’s customers	Borrower information (e.g., name, contact details, date of birth), loan details	Amazon Web Services, Inc. - cloud hosting Dublin, Ireland Oregon, USA
CreditLens KYC Screening	Client’s customers	Identifiers (e.g., name, business contact details), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities)	Amazon Web Services, Inc. - cloud hosting EMEA clients: Dublin, Ireland (primary); Frankfurt, Germany (failover) Americas clients: Virginia, USA (primary); Oregon, USA (failover) On client request: Mumbai, India WNS Global Services Private Limited – client support services India Romania
CRE Portfolio Manager	Client’s tenants	Identifiers (e.g., name), property details (e.g., address), lease details	Amazon Web Services, Inc. - cloud hosting Americas clients: Virginia, USA EMEA clients: Frankfurt, Germany Cloudflare, Inc., USA – managed web application firewall Microsoft OpenAI Azure US Central – for CRE Portfolio Assistant
eCredit	Client’s customers	Business details (e.g., name, company registration)	N/A
FACT	Client’s customers	Identifiers (e.g., name, address)	Amazon Web Services, Inc. - cloud hosting Dublin, Ireland
ImpairmentStudio	Client’s customers	Borrower information (e.g., name), loan information	Amazon Web Services, Inc. - cloud hosting N. Virginia, USA Oregon, USA On client request: Dublin, Ireland Sydney, Australia, UAE
kompany (KYC workspace, Data Remediation, KYC API Entity Verification API)	Client’s customers & suppliers	Identifiers (e.g., name, business contact details), company information (e.g., role/title, ownership/shareholding percentage)	Amazon Web Services, Inc. - cloud hosting Frankfurt, Germany next layer GmbH – cloud hosting, Vienna, Austria
Learning Solutions	Client’s employees	Learner identifiers (e.g., name, business email address), learning records	Learning Technologies Group PLC, USA – cloud hosting Adobe Inc., USA - remote support services American Information Solutions, LLC, USA - remote support services Cloudflare, Inc., USA – managed web application firewall
Lending Cloud	Client’s customers	Borrower information (e.g., name, contact details, date of birth), financial data	Amazon Web Services, Inc. - cloud hosting Oregon, USA
PassFort	Client’s prospects, customers, business partners & suppliers	Identifiers (e.g., name, contact details), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities)	Google Cloud Platform – cloud hosting Belgium, EU South Carolina, USA Microsoft Ireland Operations – cloud hosting UAE Azure Functional Software, Inc. d/b/a Sentry, USA - error tracking within the platform Elastic NV, USA - search & filtering capabilities within the platform DemystData, Ltd. UK – only applicable for Demyst Integration
ESG Module in PassFort	Client’s prospects, customers, business partners & suppliers	Identifiers (e.g., name) company information, (e.g., state/country of incorporation, address) KYC/KYS information (e.g., environment, social and governance ratings)	Google Cloud Platform – cloud hosting Belgium, EU South Carolina, USA Cloudflare, Inc., USA – managed web application firewall
MA PD in PassFort	Client’s prospects, customers, business partners & suppliers	Identifiers (e.g., name) company information, (e.g. state/country of incorporation, address) KYC/KYS information (e.g., credit risk score, probability of default, implied ratings, entity peer group)	Google Cloud Platform – cloud hosting Belgium, EU South Carolina, USA Cloudflare, Inc., USA – managed web application firewall
Standard Cyber Risk Module in PassFort	Client’s prospects, customers, business partners & suppliers	Identifiers (e.g., name, website) company information, (e.g., state/country of incorporation, address) KYC/KYS information (e.g., scores regarding security incidents/ breaches, online activities, cyber security compliance)	Google Cloud Platform – cloud hosting Belgium, EU South Carolina, USA Cloudflare, Inc., USA – managed web application firewall
PFaroe DB UK	Client’s scheme members / client’s customers’ scheme members	Unique identifier, pension details	Cloudflare, Inc., USA – managed web application firewall
Procurement Catalyst	Client’s suppliers	Identifiers (e.g., name), company information (e.g., role/title)	Amazon Web Services, Inc. - cloud hosting Frankfurt, Germany Cloudflare, Inc., USA – managed web application firewall
QUIQspread	Client’s customers	Identifiers (e.g., name)	Amazon Web Services, Inc. – cloud hosting Virginia, USA Cognaize CSJC, Armenia – financial data AI processing Vol-Smart LLC, USA – financial data AI processing Cloudflare, Inc., USA – managed web application firewall
Reporting Studio	Client's customers	Loan details (e.g., counterparty code, transaction ID)	Amazon Web Services, Inc. – cloud hosting Dublin, Ireland Singapore Sydney, Australia Cloudflare, Inc., USA – managed web application firewall
RMS (Analytical & Consulting Services, Claims & Exposure Analysis, Hosting Plus, Professional Services)	Client’s customers	Property data (e.g., latitude/longitude coordinates, address, zip code), exposure data, policy information (e.g., policy number)	Microsoft – cloud hosting Ireland, Canada
RMS (Intelligent Risk Platform)	Client’s customers	Property data (e.g., latitude/longitude coordinates, address, zip code), exposure data, policy information (e.g., policy number), business information (e.g., company name, address, industry code, assets)	Amazon Web Services, Inc. – cloud hosting Virginia, USA Dublin, Ireland Snowflake, Inc., USA – data analytics Databricks, Inc., USA, – data analytics MapBox, Inc., USA - map visualization of location data
RMS (Miu)	Client’s customers	Property data (e.g., latitude/longitude coordinates, address, zip code), exposure data, policy information (e.g., policy number), business information (e.g., company name, address, industry code, assets)	Amazon Web Services, Inc. – cloud hosting Dublin, Ireland Snowflake, Inc., USA – data analytics
Sales & Marketing Catalyst/BVD Data Matching	Client’s customers & suppliers	Identifiers (e.g., name, business contact details)	Amazon Web Services, Inc. - cloud hosting Frankfurt, Germany
Sanctions360	Client’s customers & suppliers	Identifiers (e.g., name, business contact details), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities)	Amazon Web Services, Inc. - cloud hosting Virginia, USA Cloudflare, Inc., USA – managed web application firewall
Shell Indicator	Client’s customers & suppliers	Identifiers (e.g., name), company information (e.g., role/title, ownership/shareholding percentage)	Google Cloud Platform – cloud hosting Belgium, EU South Carolina, USA Microsoft Ireland Operations – cloud hosting UAE Azure Cloudflare, Inc., USA – managed web application firewall
Supply Chain Catalyst	Client’s suppliers	Identifiers (e.g., name), company information (e.g., role/title)	Amazon Web Services, Inc. - cloud hosting Frankfurt, Germany Ireland, Dublin Cloudflare, Inc., USA – managed web application firewall
Tax Risk Catalyst	Client’s suppliers	Identifiers (e.g., name), company information (e.g., role/title)	Amazon Web Services, Inc. - cloud hosting Frankfurt, Germany Cloudflare, Inc., USA – managed web application firewall
All products and services	As above	As above	Moody’s global group companies - technical assistance and client services

* May include sole traders and unincorporated partnerships under applicable law

Updates

This list may be updated from time-to-time to meet Moody’s business needs.

Sign up to be notified of changes by submitting your email address. Any objections to changes to be notified to Moody’s under the client contract.