Descriptions of Personal Data
Processing
To provide various aspects of its products and services, Moody’s may process personal data on
behalf of its customers as a “data processor” or “service provider” (or equivalent underapplicable law). The subject matter, nature and purpose of the processing is to provide theproducts and services in the customer contract. The duration of the processing is until Moody’s
returns or deletes the personal data in accordance with the customer contract. The categoriesof personal data and individuals, third-party service providers, and processing locations aredescribed below.
Cloud hosting locations may be different than the defaults stated below, if specifically selectedby customer and as per the individual customer contract. Moody’s has entered: (i) EU standard
contractual clauses, and (ii) similar data transfer agreements under local applicable law(including the UK), both intragroup and with third-party sub-processors, where applicable.
Product/Service

Categories ofIndividuals
Individuals*
whose personal
data are (i)uploaded/saved
by customer,
and/or(ii) matched onbehalf ofcustomer

Categories of Personal Data
Personal data (i)uploaded/saved by customer,
and/or (ii) matched on behalfof customer

Sub-Processors &Location

Likely to include:

Likely to include:
Able AI/AutomatedDocuments Hub

Customer’s end
customers

Borrower information (e.g.,
Google Cloud US name, contact details, date ofcloud hostingbirth), loan details
Microsoft OpenAI
Azure US Central
Twilio, US - email
notification system

ABS Suite Plus, Lender,
ABS ESG, Manager
Modules and Recon

Customer’s end
customers

Borrower information (e.g.,address, account number,borrower type), loaninformation (e.g., loan type,asset details)

Amazon Web
Services, Inc. - cloud
hosting
EMEA customers:
Dublin, Ireland
Americascustomers: Oregon
or Virginia, USA
APAC customers:
Sydney, Australia
ABS ESG only –Oregon or Virginia,
Aspire Systems,Inc., USA - technicalsupport, systems
implementation,

quality assurance &development
Cledar Sp.zo.o.,
Poland - technicalsupport
DataArt Solutions,
US – systems
implementation,
quality assurance &development,
technical support
Datamatics Global
Services Limited,
India - technicalsupport, systems
implementation,
quality assurance &development
ICRA Analytics Ltd,
India - technicalsupport, systems
implementation,
quality assurance &development
I-Peritus Solutions& Services Private
Limited, India technical support,systems
implementation,
quality assurance &development
SMIL Group LLC,
USA - technicalsupport, systems
implementation,
quality assurance &development (ABSSuite Plus Only)
Cloudflare, Inc.,
USA – managed
web application
firewallAccelerate Farm Profits

Customer’s end
customers

Identifiers (e.g., name,location), financial
information (e.g., income,expenses), businessinformation (e.g., production,crops, livestock)Amazon Web
Services, Inc. - cloud
hosting
Oregon or Virginia,USAIntelinair, Inc., USA– field-level datamatchingTata Consultancy
Services development
AI & Client GRID Review

Customer’s endcustomers& suppliers

Identifiers (e.g., name,address, date of birth),
KYC/KYS information (e.g.,sanctions information,
political exposed persons
status, information relating to
unlawful activities)

Amazon Web
Services, Inc. - cloud
hosting
EMEA customers:
Dublin, Ireland(primary);Frankfurt, Germany(failover)
Americascustomers:
Virginia, USA(primary); Oregon,
USA (failover)On customer
request: Mumbai,India
WNS Global
Services Private
Limited, India –customer support
Databricks, Inc.,
USA, – data
analytics

Analyst GRID Review

Customer’s endcustomers& suppliers

Identifiers (e.g., name,address, date of birth),
KYC/KYS information (e.g.,sanctions information,political exposed persons
status, information relating tounlawful activities)

Cloudflare, Inc.,
USA – managed
web application
firewallAmazon Web
Services, Inc. - cloud
hosting
EMEA customers:
Dublin, Ireland(primary);Frankfurt, Germany(failover)
Americascustomers:
Virginia, USA(primary); Oregon,USA (failover)On customer
request: Mumbai,India
WNS Global
Services Private
Limited, India,
Romania –customer support,
analyst review

ServicEngine Ltd,
Bangladesh –analyst review
Databricks, Inc.,
USA, – dataanalytics

AXIS

Banking Cloud;
RiskConfidence Fit+

Compliance Catalyst

Customer’s
policyholders

Customer’s end
customers

Customer’s end
customers& suppliers

Demographic data (e.g., age,gender, smoker/non-smoker
status)Identifiers (e.g., name,contact details, date of birth)

Identifiers (e.g., name,business contact details),
KYC/KYS information (e.g.,sanctions information,
political exposed persons
status, information relating tounlawful activities)

Cloudflare, Inc.,
USA – managed
web application
firewallAmazon Web
Services, Inc. - cloud
hostingAWS US East 1
Microsoft – cloud
hosting Azure East
US, Canada & North
EuropeAmazon Web
Services, Inc. - cloud
hosting
EMEA customers:
Dublin, Ireland
UAE (on request)
APAC customers:
Sydney, Australia /Singapore
Cloudflare, Inc.,
USA – managed
web application
firewallAmazon Web
Services, Inc. - cloud
hostingFrankfurt, Germany
For GRID integration:
EMEA region:
Dublin, Ireland(primary); Frankfurt,
Germany (failover)
Americas region:
US East 1 Virginia(primary); US West 2
Oregon (failover)
APAC region:
Mumbai, India(onrequest)
Cloudflare, Inc.,
USA – managed
web application
firewallCredit Catalyst

Customer’s endcustomers& suppliers

Identifiers (e.g., name,business contact details),
KYC/KYS information (e.g.,sanctions information,
political exposed persons
status, information relating tounlawful activities)

Amazon Web
Services, Inc. - cloud
hostingFrankfurt, Germany
For GRID integration:
Dublin, Ireland(primary); Frankfurt,
Germany (failover)
Cloudflare, Inc.,
USA – managed
web application
firewallCreditLens (CRE/C&IModules)

Customer’s end
customers

Borrower information (e.g.,name, contact details, date ofbirth), loan details

Amazon WebServices, Inc. - cloud
hosting
EMEA: Dublin,Ireland
Americas: Oregon,
USA
APAC: Sydney,
Australia /Singapore
Microsoft OpenAI
Azure US Central –applicable for GenAI
Credit Memo & Able
AI functionality
Google Cloudhosting US – only
applicable for Able
AI functionality

CreditLens Front Office
CreditLens Automation
CreditLens Back Office

Customer’s end
customers

Borrower information (e.g.,name, contact details, date ofbirth), loan details

CreditLens Monitor

Customer’s endcustomers

Borrower information (e.g.,name, contact details, date ofbirth), loan details

CreditLens KYC Screening

Customer’s end
customers

Identifiers (e.g., name,business contact details),
KYC/KYS information (e.g.,sanctions information,
political exposed persons
status, information relating tounlawful activities)

Twilio- Able AI
functionality
Amazon Web
Services, Inc. - cloud
hosting
EMEA:
Dublin, Ireland
Americas:
Oregon, USA
APAC:
Sydney, Australia /Singapore
Numerated GrowthTechnologies, Inc.,
USA, digital loan
origination system
Amazon Web
Services, Inc. - cloud
hosting
Dublin, Ireland
Oregon, USAAmazon Web
Services, Inc. - cloud
hosting
EMEA:
Dublin, Ireland
Americas:
Oregon, USA
APAC:
Sydney, Australia /Singapore

CRE Portfolio Manager

Customer’s tenants Identifiers (e.g., name),
property details (e.g.,address), lease details

Amazon Web
Services, Inc. - cloud
hosting
Americascustomers:
Virginia, USA
EMEA
customers:
Frankfurt, Germany
Cloudflare, Inc.,
USA – managed
web application
firewallCredit View Research
AssistantCustomer’s end
customers

Identifiers (e.g. name, date ofbirth, contact details),
gender, nationality, shareownershipMicrosoft OpenAI
Azure US Central –for CRE Portfolio
AssistantAmazon Web
Services Inc. – cloud
hosting- AWS US East
1 (Virginia) & US
West 2 (Oregon)
Microsoft Azure
Central US

eCredit

Customer’s end
customers
Customer’s end
customers

Business details (e.g., name,company registration)
Identifiers (e.g., name,address)

Flair Diligence

Customer’s
suppliers

ImpairmentStudio

Customer’s end
customers

Business details (e.g.,company name, registeredoffice, phone numbers)
Associated individuals (name,date of appointment,
title/role, nationality, PEP
status, adverse media,
sanctions)
Borrower information (e.g.,name), loan information

FACT

Cloudflare, Inc.,
USA – managed
web application
firewall
N/AAmazon Web
Services, Inc. - cloud
hosting
Dublin, Ireland
OVH Group SA, OVH
cloud, France

Amazon Web
Services, Inc. - cloud
hosting
Virginia, USA
Oregon, USA
On customer
request: Dublin,
Ireland Sydney,
Australia,
UAE, Singapore

kompany (KYC
workspace, Data
Remediation, KYC API)

Customer’s end
customers& suppliers

Identifiers (e.g., name,business contact details),
company information (e.g.,role/title,ownership/shareholding
percentage)

Amazon WebServices, Inc. - cloud
hostingFrankfurt, Germany
next layer GmbH –cloud hosting,
Vienna, Austria
Cloudflare, Inc.,
USA – managed
web application
firewallkompany (EntityVerification API)

Customer’s end
customers& suppliers

Identifiers (e.g., name,business contact details),
company information (e.g.,role/title,ownership/shareholdingpercentage)

Google Cloud
Platform,
hosting
locations - GCP
US Central 1(Iowa), GCP US
East 1 (SouthCarolina)
Cloudflare, Inc.,
USA – managed
web application
firewall

Learning Solutions

Customer’s
employees

Learner identifiers (e.g.,name, business emailaddress), learning records

LearningTechnologies Group
PLC, USA– cloud hosting
Adobe Inc., USA- remote support
servicesAmerican Information
Solutions, LLC, USA- remote support
services
Cloudflare, Inc., USA– managed web
application
firewallLending Cloud

Customer’s
customers

Moody’s Investigation
Tool

Customer’s
Identifiers (e.g., name,prospects,contact details), KYC/KYS
customers, business information (e.g., sanctions
partners &information, politicalsuppliers
exposed persons status,
information relating to
unlawful activities).

Blackdot Solution Ltd'sAWS Hosting in London.

Customer’s
prospects,customers,
business partners& suppliers

Identifiers (e.g., name,contact details), KYC/KYS
information (e.g., sanctions
information, political
exposed persons status,
information relating tounlawful activities).
ESG information (e.g.,
environment, social andgovernance ratings -ESGModule).
Probability of default
information (e.g., credit risk
score, probability of default,
implied ratings, entity peergroup - Probability ofDefault Module).
Cyber risk information (e.g.,scores regarding security
incidents/ breaches, online
activities, cyber security
compliance - Cyber RiskModule).
Forced labor risk information(e.g. contact information,financial, entity, pay, industry,organizational, humanresources, revenue and spend
information and human rights
processes

Google Cloud
Platform – cloud
hosting Belgium, EU
South Carolina, USA

Unique identifier, pension
details

Cloudflare, Inc., USA– managed web
application
firewall

PassFort

PFaroe DB UK

Customer’s
scheme members/ customer’s
customers’
scheme members

Borrower information (e.g.,
Amazon Web Services,name, contact details, date of Inc. - cloud hosting
Oregon, USAbirth), financial data

AWS- US-East-1 VirginiaHosting for Moody’s

Microsoft – cloud hosting
UAE Azure
Functional Software,
Inc. d/b/a Sentry, USA error tracking within theplatform
Elastic NV, USA search & filtering
capabilities within theplatform
Demyst Data, Ltd. UK –only applicable for
Demyst Integration

Cloudflare, Inc., USA– managed web
application firewallonly applicable for
ESG, Probability ofDefault & Cyber Risk
Module in PassFort)

PortfolioStudio

Customer’s end
customers

Borrower information (e.g.,name), loan information

Procurement Catalyst

Customer’s
suppliers

Identifiers (e.g., name),company information (e.g.,role/title)

Amazon Web Services,
Inc. - cloud hosting
Virginia, USA
Oregon, USA
On customer request:
Dublin, Ireland
Indonesia
Sydney, Australia,
UAE
Amazon Web Services,
Inc. - cloud hostingFrankfurt, Germany
Cloudflare, Inc., USA– managed web
application
firewallPulse -Risk Assessment
Platform

Customer’s end
customers

Identifiers (e.g., name,address)

Cloudflare, Inc., USA –managed web application
firewallQUIQspread

Customer’scustomers

Identifiers (e.g., name)Amazon Web
Services, Inc. –cloud hosting
Virginia, USA
Dublin, Ireland
Singapore,
UAE
Cognaize CSJC,
Armenia – financial
data AI processing
Vol-Smart LLC, USA– financial data AIprocessing

Reporting Studio

RMS - Analytical &Consulting Services,
Claims & Exposure
Analysis, Hosting Plus,
Professional Services

RMS - Intelligent Risk
Platform (including Risk
Modeler, ExposureIQ,
UnderwriteIQ, TreatyIQ,
SiteIQ, Location
Intelligence API, Data
Bridge, Climate onDemand, Risk Data Lake,
Integration Center VPN,
Admin Center, Risk Data
Exchange, Risk Data Labs)

RMS - Miu

Customer’s
customers

Customer’scustomers

Customer’scustomers

Loan details (e.g.,counterparty code,transaction ID)

Property data (e.g.,latitude/longitudecoordinates, address, zipcode), exposure data, policy
information (e.g., policynumber)

Property data (e.g.,
latitude/longitude
coordinates, address, zipcode), exposure data, policy
information (e.g., policynumber), businessinformation (e.g., company
name, address, industry code,assets)

Cloudflare, Inc.,
USA – managed
web application
firewallAmazon Web
Services, Inc. –cloud hosting
Dublin, Ireland
Singapore
Sydney, Australia
Cloudflare, Inc.,
USA – managed
web application
firewallFor IRP products:
Microsoft – cloudhosting Ireland,
CanadaFor Cloud Solutions:
AWS (customer canchoose Ireland orEast US)
Amazon Web
Services, Inc. –cloud hosting
Virginia, USA
Dublin, Ireland
Snowflake, Inc.,
USA – data analytics
Databricks, Inc.,
USA, – dataanalytics

Customer’s
customers

Property data (e.g.,
latitude/longitude

MapBox, Inc., USA map visualization oflocation data
Amazon Web
Services, Inc. –Sales & Marketing
Catalyst/BVD Data
Matching

Customer’s
customers& suppliers

Sanctions360

Customer’s
customers& suppliers

coordinates, address, zipcode), exposure data, policy
information (e.g., policynumber), businessinformation (e.g., company
name, address, industry code,assets)
Identifiers (e.g., name,business contact details)

Identifiers (e.g., name,business contact details),
KYC/KYS information (e.g.,sanctions information,political exposed persons
status, information relating to
unlawful activities)

cloud hosting
Dublin, Ireland
Snowflake, Inc.,
USA – data analytics

Amazon Web
Services, Inc. - cloud
hostingFrankfurt, Germany
Amazon Web
Services, Inc. - cloud
hosting
Virginia, USA

Cloudflare, Inc.,
USA – managed
web application
firewall
Shell Indicator

Supply Chain Catalyst(with Multi-Tier RiskVisibility)Customer’s
customers& suppliers

Identifiers (e.g., name),company information (e.g.,role/title,ownership/shareholdingpercentage)

Customer’s
suppliers

Identifiers (e.g., name),company information (e.g.,role/title)

Amazon Web
Services (us East:North Virginia)

Amazon Web
Services, Inc. - cloud
hostingFrankfurt, Germany
Cloudflare, Inc.,
USA – managed
web application
Firewall
Altana Technologies,Inc.
25 Kent Ave, Suite
501, Brooklyn, NY
11249 – MTRV
application & remotesupport services.

Tax Risk Catalyst

Customer’s
suppliers

Identifiers (e.g., name),company information (e.g.,role/title)

Amazon Web
Services, Inc. - cloud
hosting Frankfurt,
Germany
Cloudflare, Inc.,
USA – managed
web application
firewallAll products and services

As above

As above

Moody’s global
group companies technical assistanceand customerservices* May include sole traders and unincorporated partnerships under applicable law
UpdatesThis list may be updated from time-to-time to meet Moody’s business needs.
Sign up here to be notified of changes
Any objections to changes to be notified to Moody’s under the customer contract.