To provide various aspects of its products and services, Moody’s may process personal data on behalf of its customers as a “data processor” or “service provider” (or equivalent under applicable law). The subject matter, nature and purpose of the processing are per the customer agreement. The duration of the processing is until Moody’s returns or deletes the personal data in accordance with the customer contract. The categories of personal data and individuals, third-party service providers, and processing locations are described below. Cloud hosting locations may be different than the defaults stated below, if specifically selected by customer and as per the individual customer contract. Moody’s has entered into: (i) EU standard contractual clauses, and (ii) similar data transfer agreements under local applicable law (including the UK), both intragroup and with third-party sub-processors, where applicable.
Categories of Individuals: Individuals* whose personal data are (i) uploaded/saved by customer, and/or (ii) matched, analyzed, or otherwise processed on behalf of the customer
Categories of Personal Data: Personal data (i) uploaded/saved by customer, and/or (ii) matched, analyzed, or otherwise processed on behalf of the customer
Intragroup support: Moody’s affiliates global locations — technical assistance and customer services for products listed below.
* May include sole traders and unincorporated partnerships under applicable law
Updates: This list may be updated from time-to-time to meet Moody’s business needs. Sign up here to be notified of changes. Any objections to changes to be notified to Moody’s under the customer contract.
Categories of Individuals: Customer’s customers
Categories of Personal Data: Borrower information (e.g., name, contact details, date of birth), loan details
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Borrower information (e.g., address, account number, borrower type), loan information (e.g., loan type, asset details)
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Identifiers (e.g., name, location), financial information (e.g., income, expenses), business information (e.g., production, crops, livestock)
Sub-Processors & Location:
Categories of Individuals: Customer’s customers & suppliers
Categories of Personal Data: Identifiers (e.g., name, address, date of birth), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities)
Sub-Processors & Location:
Categories of Individuals: Customer’s customers & suppliers
Categories of Personal Data: Identifiers (e.g., name, address, date of birth), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities)
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Property data (e.g., latitude/longitude coordinates, address, zip code), exposure data, policy information (e.g., policy number)
Sub-Processors & Location:
- Amazon Web Services, Inc., US - London, UK; California, US
- Additional hosting locations for Professional Services: Microsoft Azure - Canada; Amazon Web Services Inc., US - Germany; France
Categories of Individuals: Customer’s customers
Categories of Personal Data: Identifiers, financial information (e.g., income), loan details
Sub-Processors & Location:
– Americas customers: Oregon, US; Denver, US. For Borrower Portal: Virginia US; Ohio, US
– EMEA customers: Dublin, Ireland
– APAC customers: Sydney, Australia; Singapore
Categories of Individuals: Customer’s customers
Categories of Personal Data: Identifiers, company information, company reports and industry information
Sub-Processors & Location:
– Customer election: AWS Oregon, US; Dublin, Ireland; Sydney, Australia; Singapore
Categories of Individuals: Customer’s customers
Categories of Personal Data: Identifiers, financial information
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Identifiers (e.g., name, contact details, date of birth)
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Property data (e.g., latitude/longitude coordinates, address, zip code), exposure data, security identifiers, business information (e.g., company name, address, occupancy)
Sub-Processors & Location:
Categories of Individuals: Customer’s customers & suppliers
Categories of Personal Data: Identifiers (e.g., name, business contact details), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities)
Sub-Processors & Location:
For GRID integration:
- EMEA region: Dublin, Ireland (primary); Frankfurt, Germany (failover)
- Americas region: Virginia, US (primary); Oregon, US (failover)
- APAC region: Mumbai, India
Categories of Individuals: Customer’s customers
Categories of Personal Data: Identifiers (e.g., name, business contact details), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities)
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Borrower information (e.g., address, account number, borrower type), loan information (e.g., loan type, asset details)
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Borrower information (e.g., name, contact details, date of birth), loan details
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Borrower information (e.g., name, contact details, date of birth), loan details
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Identifiers (e.g., name, business contact details), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities)
Sub-Processors & Location:
Categories of Individuals: Customer’s tenants
Categories of Personal Data: Identifiers (e.g., name), property details (e.g., address), lease details
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Business details (e.g., name, company registration)
Sub-Processors & Location: No sub-processors. Processing location: US
Categories of Individuals: Customer’s customers & suppliers
Categories of Personal Data: Company/Business Name, Country of location, Unique identity number or registration, Stock or Securities number, Trade register or VAT number, financial statements, Qualitative assessment of company, Company Loan (not consumer) Details used in LGD calculation
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Identifiers (e.g., name, address)
Sub-Processors & Location:
Categories of Individuals: Customer’s suppliers
Categories of Personal Data: Business details (e.g., company name, registered office, phone numbers) Associated individuals (name, date of appointment, title/role, nationality, PEP status, adverse media, sanctions)
Sub-Processors & Location:
Categories of Individuals: Customer’s customers & suppliers
Categories of Personal Data: Identifiers (e.g., name, business contact details)
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Property data (e.g., latitude/longitude coordinates, address, zip code), exposure data, policy information (e.g., policy number)
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Borrower information (e.g., name), loan information
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Property data (e.g., latitude/longitude coordinates, address, zip code), exposure data, policy information (e.g., policy number), business information (e.g., company name, address, industry code, assets)
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Identifiers (e.g., name, business contact details), company information (e.g., role/title, ownership/shareholding percentage)
Sub-Processors & Location:
Categories of Individuals: Customer’s customers & suppliers
Categories of Personal Data: Identifiers (e.g., name, business contact details), company information (e.g., role/title, ownership/shareholding percentage)
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Borrower information (e.g., name, contact details, date of birth), loan details
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Borrower information (e.g., name, contact details, date of birth), loan details
Sub-Processors & Location:
For Automated Spreading (QUIQspread)
For Automated Spreading (Numerated)
For Automated Credit Memo
For Borrower Engagement & Small Business
Categories of Individuals: Customer’s customers
Categories of Personal Data: Identifiers (e.g., age, gender, country)
Sub-Processors & Location:
Categories of Individuals: Customer’s prospects, customers, business partners & suppliers
Categories of Personal Data: Identifiers (e.g., name, contact details, BVD ID & BVD information), KYC/KYS information (e.g., sanctions and adverse media information, political exposed persons status, information relating to unlawful & criminal activities), ID data (e.g., copy of ID documents, photograph), Financial information, Risk profile data, Transactions flagged for review, Biometric & Video data), EDF-X Data (Probability of default) (e.g., probability of default score, Moody’s implied ratings & entity peer group), Cyber Risk Data (e.g., scores regarding security incidents/breaches, online activities & cyber security compliance), ESG data (e.g. ESG data which includes scores of environment, social and governance ratings), Forced Labor Risk information (e.g., entity information, organizational and human resources information, pay information, industry information, revenue and spend information, human rights processes).
Sub-Processors & Location:
Categories of Individuals: Customer’s prospects, customers, business partners & suppliers
Categories of Personal Data: Identifiers (e.g., name, contact details), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities).
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Property data (e.g., latitude/longitude coordinates, address, zip code), exposure data, policy information (e.g., policy number), business information (e.g., company name, address, industry code, assets)
Sub-Processors & Location:
Categories of Individuals: Customer’s prospects, customers, business partners & suppliers
Categories of Personal Data: Identifiers (e.g., name, contact details), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities). ESG information (e.g., environment, social and governance ratings — ESG Module). Probability of default information (e.g., credit risk score, probability of default, implied ratings, entity peer group — Probability of Default Module). Cyber risk information (e.g., scores regarding security incidents/ breaches, online activities, cyber security compliance — Cyber Risk Module). Forced labor risk information (e.g. contact information, financial, entity, pay, industry, organizational, human resources, revenue and spend information and human rights processes.
Sub-Processors & Location:
Categories of Individuals: Customer’s scheme members / customer’s customers’ scheme members
Categories of Personal Data: Unique identifier, pension details
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Borrower information (e.g., name), loan information
Sub-Processors & Location:
Categories of Individuals: Customer’s suppliers
Categories of Personal Data: Identifiers (e.g., name), company information (e.g., role/title)
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Identifiers (e.g., name, address)
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Identifiers (e.g., name)
Sub-Processors & Location:
Categories of Individuals: Customer’s customers
Categories of Personal Data: Loan details (e.g., counterparty code, transaction ID)
Sub-Processors & Location:
Categories of Individuals: Customer’s customers & suppliers
Categories of Personal Data: Identifiers (e.g., name, business contact details), KYC/KYS information (e.g., sanctions information, political exposed persons status, information relating to unlawful activities)
Sub-Processors & Location:
Categories of Individuals: Customer’s customers & suppliers
Categories of Personal Data: Identifiers (e.g., name), company information (e.g., role/title, ownership/shareholding percentage)
Sub-Processors & Location:
Categories of Individuals: Customer’s suppliers
Categories of Personal Data: Identifiers (e.g., name), company information (e.g., role/title)
Sub-Processors & Location:
Categories of Individuals: Customer’s suppliers
Categories of Personal Data: Identifiers (e.g., name), company information (e.g., role/title)
Sub-Processors & Location: