Sub-Processor Policy

Effective Date: February 3, 2026

To provide our Services, Scallably, a trading name of MTS Media  Ltd., engages a number of third-party service providers ("Sub-processors") to process Customer Data. This policy provides information about these Sub-processors and our process for engaging them.

1. Our Commitment

Scallably is committed to ensuring that all our Sub-processors meet the high standards for data protection and security that our customers expect. We conduct a thorough due diligence process before engaging any Sub-processor and require them to enter into a data processing agreement that complies with GDPR.

2. Due Diligence and Contractual Safeguards

Before engaging a new Sub-processor, we:

Assess their security and privacy practices: We review their security certifications (e.g., SOC 2, ISO 27001) and data protection policies.

Sign a Data Processing Agreement (DPA): We require each Sub-processor to sign a DPA that includes data protection obligations no less protective than those in our own DPA with our customers.

Ensure lawful data transfers: For any international transfers of data, we ensure that appropriate safeguards (such as Standard Contractual Clauses) are in place.

3. List of Sub-processors

Below is a list of the Sub-processors we currently use to provide our Services. This list is updated as our service providers change.