Descriptions of Personal Data Processing
To provide various aspects of its products and services, Moody’s may process personal data on behalf of its clients as a “data processor” or “service provider” (or equivalent under applicable law). The subject matter, nature and purpose of the processing is to provide the products and services in the client contract. The duration of the processing is until Moody’s returns or deletes the personal data in accordance with the client contract. The categories of personal data and individuals, third-party service providers, and processing locations are described below.
Cloud hosting locations may be different than the defaults stated below, if specifically selected by client and as per the individual client contract. Moody’s has entered into: (i) EU standard contractual clauses, and (ii) similar data transfer agreements under local applicable law (including the UK), both intragroup and with third-party sub-processors, where applicable.
Product/ Service |
Categories of Individuals Individuals* whose personal data are (i) uploaded/saved by client, and/or (ii) matched on behalf of client |
Categories of Personal Data Personal data (i) uploaded/saved by client, and/or (ii) matched on behalf of client |
Sub-Processors & Location |
ABS Suite Plus / ABS Lender / ABS ESG |
Client’s customers |
Borrower information (e.g., address, account number, borrower type), loan information (e.g., loan type, asset details) |
Amazon Web Services, Inc. - cloud hosting
ABS ESG - US hosting only
DataArt Solutions
Cloudflare, Inc., USA – managed web application firewall |
Accelerate Farm Profits |
Client’s customers |
Identifiers (e.g., name, location), financial information (e.g., income, expenses), business information (e.g., production, crops, livestock) |
Amazon Web Services, Inc. - cloud hosting USA |
AI & Client GRID Review |
Client’s customers & suppliers |
Identifiers (e.g., name, address, date of birth), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities) |
Amazon Web Services, Inc. - cloud hosting
Databricks, Inc., USA, – data analytics platform as a service for evaluation, build and testing of data models |
Analyst GRID Review |
Client’s customers & suppliers |
Identifiers (e.g., name, address, date of birth), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities) |
Amazon Web Services, Inc. - cloud hosting
Databricks, Inc., USA, – data analytics platform as a service for evaluation, build and testing of data models |
Banking Cloud; RiskConfidence Fit+ |
Client’s customers |
Identifiers (e.g., name, contact details, date of birth) |
Amazon Web Services, Inc. - cloud hosting
Cloudflare, Inc., USA – managed web application firewall |
BVD Data Matching |
Client’s customers & suppliers |
Identifiers (e.g., name, business contact details) |
Amazon Web Services, Inc. - cloud hosting |
Compliance Catalyst |
Client’s customers & suppliers |
Identifiers (e.g., name, business contact details), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities) |
Amazon Web Services, Inc. - cloud hosting
Cloudflare, Inc., USA – managed web application firewall |
Credit Catalyst |
Client’s customers & suppliers |
Identifiers (e.g., name, business contact details), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities) |
Amazon Web Services, Inc. - cloud hosting
Cloudflare, Inc., USA – managed web application firewall |
CreditLens (CRE/C&I Modules) CreditLens Monitor CreditLens Front Office CreditLens Automation |
Client’s customers |
Borrower information (e.g., name, contact details, date of birth), loan details |
Amazon Web Services, Inc. - cloud hosting CreditLens CRE/C&I Modules – CreditLens Monitor - Oregon, USA only Numerated Growth Technologies, Inc., USA, digital loan origination system – only applicable for CreditLens Front Office CreditLens Automation |
CreditLens KYC Screening |
Client’s customers |
Identifiers (e.g., name, business contact details), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities) |
Amazon Web Services, Inc. - cloud hosting |
CRE Portfolio Manager |
Client’s tenants |
Identifiers (e.g., name), property details (e.g., address), lease details |
Amazon Web Services, Inc. - cloud hosting
Cloudflare, Inc., USA – managed web application firewall |
eCredit |
Client’s customers |
Business details (e.g., name, company registration) |
N/A
|
FACT |
Client’s customers |
Identifiers (e.g., name, address) |
Amazon Web Services, Inc. - cloud hosting |
ImpairmentStudio |
Client’s customers |
Borrower information (e.g., name), loan information |
Amazon Web Services, Inc. - cloud hosting N. Virginia, USA On client request: Dublin, Ireland |
kompany (KYC workspace, Data Remediation, KYC API |
Client’s customers & suppliers |
Identifiers (e.g., name, business contact details), company information (e.g., role/title, ownership/shareholding percentage) |
Amazon Web Services, Inc. - cloud hosting |
Learning Solutions |
Client’s employees |
Learner identifiers (e.g., name, business email address), learning records |
Learning Technologies Group PLC, USA – cloud hosting Cloudflare, Inc., USA – managed web application firewall |
Lending Cloud |
Client’s customers |
Borrower information (e.g., name, contact details, date of birth), financial data |
Amazon Web Services, Inc. - cloud hosting |
PassFort |
Client’s prospects, customers, business partners & suppliers |
Identifiers (e.g., name, contact details), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities) |
Google Cloud Platform – cloud hosting
Microsoft Ireland Operations – cloud hosting DemystData, Ltd. UK – only applicable for Demyst Integration |
ESG Module in PassFort |
Client’s prospects, customers, business partners & suppliers |
Identifiers (e.g., name) company information, (e.g., state/country of incorporation, address) |
Google Cloud Platform – cloud hosting Cloudflare, Inc., USA – managed web application firewall |
MA PD in PassFort |
Client’s prospects, customers, business partners & suppliers |
Identifiers (e.g., name) company information, (e.g. state/country of incorporation, address) |
Google Cloud Platform – cloud hosting Cloudflare, Inc., USA – managed web application firewall |
Standard Cyber Risk Module in PassFort |
Client’s prospects, customers, business partners & suppliers |
Identifiers (e.g., name, website) company information, (e.g., state/country of incorporation, address) |
Google Cloud Platform – cloud hosting Cloudflare, Inc., USA – managed web application firewall |
PFaroe DB UK |
Client’s scheme members / client’s customers’ scheme members |
Unique identifier, pension details |
Cloudflare, Inc., USA – managed web application firewall |
Procurement Catalyst |
Client’s suppliers |
Identifiers (e.g., name), company information (e.g., role/title) |
Amazon Web Services, Inc. - cloud hosting Cloudflare, Inc., USA – managed web application firewall |
QUIQspread |
Client’s customers |
Identifiers (e.g., name) |
Amazon Web Services, Inc. – cloud hosting Cloudflare, Inc., USA – managed web application firewall |
Reporting Studio |
Client's customers |
Loan details (e.g., counterparty code, transaction ID) |
Amazon Web Services, Inc. – cloud hosting |
RMS (Analytical & Consulting Services, Claims & Exposure Analysis, Cloud Solutions, Exposure iQ, Hosting Plus, Professional Services) |
Client’s customers |
Property data (e.g., latitude/longitude coordinates, address, zip code), exposure data, policy details |
Amazon Web Services, Inc. – cloud hosting |
Sanctions360 |
Client’s customers & suppliers |
Identifiers (e.g., name, business contact details), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities) |
Amazon Web Services, Inc. - cloud hosting Cloudflare, Inc., USA – managed web application firewall |
Shell Indicator |
Client’s customers & suppliers |
Identifiers (e.g., name), company information (e.g., role/title, ownership/shareholding percentage) |
Google Cloud Platform – cloud hosting
Microsoft Ireland Operations – cloud hosting Cloudflare, Inc., USA – managed web application firewall |
Supply Chain Catalyst |
Client’s suppliers |
Identifiers (e.g., name), company information (e.g., role/title) |
Amazon Web Services, Inc. - cloud hosting Cloudflare, Inc., USA – managed web application firewall |
Tax Risk Catalyst |
Client’s suppliers |
Identifiers (e.g., name), company information (e.g., role/title) |
Amazon Web Services, Inc. - cloud hosting Cloudflare, Inc., USA – managed web application firewall |
All products and services |
As above |
As above |
Moody’s global group companies - technical assistance and client services |
* May include sole traders and unincorporated partnerships under applicable law
This list may be updated from time-to-time to meet Moody’s business needs.
Sign up to be notified of changes by submitting your email address.
Any objections to changes to be notified to Moody’s under the client contract.