PayComply - Sub-Processor Disclosure

Last Updated: 10-October-2025

This Sub-Processor Disclosure describes the third parties (“Sub-Processors”) engaged by Valueance Technology Solutions LLP (“Valueance”, “we”, “us”) in connection with the provision of the PayComply SaaS payroll and compliance platform (the “Services”).

This page is provided for transparency and forms part of the contractual documentation referenced in the PayComply Master Services Agreement (MSA) and Annexure A - Data Processing Addendum (DPA).

1. What Is a Sub-Processor?

A Sub-Processor is a third party engaged by Valueance to process Personal Data on behalf of our customers solely for the purpose of delivering, securing, operating, or supporting the PayComply Services.

All Sub-Processors:

• Are engaged under written agreements
• Are bound by confidentiality and data protection obligations
• Implement security measures aligned with industry standards (including ISO 27001 / SOC 2-aligned controls)

2. Categories of Sub-Processors

Valueance may engage Sub-Processors in the following functional categories:

• Cloud infrastructure and hosting
• Data storage and backup
• Email and notification delivery
• Application monitoring and security
• Customer support tooling
• Accounting, compliance, and audit support (limited access only)

3. List of Authorized Sub-Processors

Note: Access to Personal Data is limited to the minimum necessary and subject to role-based access controls.

4. Data Protection & Security Commitments

Valueance ensures that each Sub-Processor:

• Processes Personal Data only on documented instructions from Valueance
• Implements appropriate security measures aligned with ISO/IEC 27001 principles and SOC 2 Trust Services Criteria
• Is subject to periodic security and compliance reviews
• Notifies Valueance without undue delay of any confirmed data breach affecting Personal Data

5. Cross-Border Data Transfers

Where Sub-Processors are located outside India, Valueance ensures that:

• Transfers comply with applicable Indian data protection laws, including the Digital Personal Data Protection Act, 2023
• Contractual safeguards and technical measures are in place to protect Personal Data

6. Sub-Processor Change Control

Valueance may update this Sub-Processor list periodically. Material changes, including engagement of a new Sub-Processor that processes Personal Data, shall follow the Sub-Processor Change Control process in Annexure A, Schedule B of the PayComply DPA. Customers may raise reasonable, documented objections as described in the DPA.

7. Payroll Service Providers & End-Customer Context

Where a customer is a Payroll Service Provider using PayComply for its own clients:

• Valueance acts as a Sub-Processor
• The Payroll Service Provider remains responsible for transparency toward its end-customers and employees
• This disclosure supports downstream compliance and audit requirements

8. Updates to This Page

This page may be updated periodically to reflect changes in Valueance’s Sub-Processor ecosystem. The “Last Updated” date at the top of this page indicates when it was most recently revised.

9. Contact Information

For questions regarding this Sub-Processor Disclosure, please contact:

Data Protection Officer / Privacy Team
privacy@valueance.com
Valueance Technology Solutions LLP