Elavon Financial Services DAC
Payment Services Business Lines: Elavon Merchant Services & Opayo by Elavon Service Providers/Sub-Processors List
Last update: August 31st, 2023
Last update: August 31st, 2023
As a regulated credit institution operating in several geographies in Europe, Elavon Financial Services DAC (‘Elavon’) takes its responsibilities of compliance extremely seriously. This includes a commitment to complying with all applicable Data Protection, Privacy and Security Laws and Regulations (collectively referred to as Requirements) in the locations in which it operates.
To comply with the relevant European Requirements, Elavon has established an EU Data Protection Framework that is constructed around the key Requirements and aligned to relevant internal policies, programs and controls as relevant. For example, Elavon has a range of security policies in place that document and outline the company approach and control environment in terms of the processing, transmission and storage of ‘Personal Data’ and ‘other Sensitive Information’.
The EU Data Protection Framework determines how Elavon will collect, process, store, share or disclose, protect and use the Personal Data of its customers, partners and others. It is reviewed regularly and updated as appropriate to reflect changing regulatory requirements or industry standards.
All Third Parties that Elavon engages will be obliged to understand and protect all rights from Elavon Customers and Elavon will generally be liable towards the Customers within the limitation of liability agreed between the parties for the services that the Third Parties provide.
Where Elavon engages a Third Party to assist in its Processing activities, it will choose a Data Processor who has in place sufficient technical and organisational security measures to protect Personal Data and takes reasonable steps to ensure compliance with those measures.
It is the Policy of Elavon to enter into a written contract, or equivalent, when engaging a Third Party to Process Personal Data on its behalf. The contract, or equivalent, will clearly set out the responsibilities of the respective parties and will be constructed in a manner to ensure compliance with relevant Data Protection requirements under European and local Member State legislation.
Elavon Business Lines and Support Functions are required to ensure that all Third-Party relationships are established and maintained in accordance with the Third-Party Risk Management Policy and the Contracting Policy.
Elavon operates in compliance with a comprehensive Third Party Risk Management Policy, which defines a risk-based framework that Elavon uses to manage its Third Party relationships (TPRs).
When engaging a Third Party, Elavon conducts appropriate risk management activities to manage the Company’s corresponding risks, including, but not limited to, operational, compliance, reputation, strategic, concentration, and credit risks as defined in its Risk Management Framework and applicable laws and regulations.
Accordingly, the decision by Elavon to engage a Third Party must be consistent with the Company’s business objectives and made only after robust due diligence and strong consideration of the risks involved.
Each prospective TPR is subject to due diligence, from which the Company will determine whether to proceed to the next risk management phase. A comprehensive risk assessment must be performed and subjected to requisite approvals before entering into a contract with the Third Party.
Elavon Business Lines manage the provision of products/services to the Company on an ongoing basis, regardless of whether performance is by a Third Party or through one or more Fourth Parties. After engaging a Third Party, each Business Line manages the performance of relationship activities (whether the performance is ultimately provided by the Third Party and/or through one or more Fourth Parties) on an ongoing basis for compliance with agreed-upon performance and risk standards. The TPRM Program incorporates a risk-based approach to guide the Business Lines in their decisions on content and frequency of ongoing management activities.
From the population of Third Parties within the TPRM Program, we have identified a list of Service Providers/Sub-Processors of Personal Data, which is provided below.
To note, this list contains Service Providers/Sub-Processors who are engaged by Elavon across its EMS and Opayo Business Lines and who may have access to cardholder data.
The list of Service Providers/Sub-Processors who are engaged by Elavon’s EMS and Opayo Business Lines and who may have access to cardholder data are:
Entity Name |
Type |
Purpose |
Business Line |
---|---|---|---|
Amazon Web Services, Inc. |
Infrastracture Service Specific |
Cloud Infrasctucutre Provider and application service provider |
EMS Opayo |
BT Communications Ireland Limited |
Infrastructure |
Data centre service provider |
EMS Opayo |
CCV Group B.V. |
Service Specific |
Payment transaction routing service |
EMS |
Computop Paygate GmbH |
Service Specific |
Payment processing services |
EMS |
DataFlexNet Ltd |
Service Specific |
Payment transaction routing service |
EMS |
Digital London Limited |
Infrastructure |
Data centre service provider |
Opayo |
Equens Worldline SE |
Service Specific |
Payment transaction routing service |
EMS |
Equinix Inc. |
Infrastructure |
Data centre service provider |
EMS Opayo |
Evry Norge AS |
Service Specific |
Payment network transaction services |
EMS |
Featurespace Inc. |
Service Specific |
Fraud software services |
EMS Opayo |
Fexco Merchant Services |
Service Specific |
Partner to provide currency conversion services |
EMS Opayo |
Finastra Technology Inc. |
Service Specific |
Software solution services |
EMS |
FreedomPay World Europe Limited |
Service Specific |
Payment solutions service |
EMS |
Futurex, LP |
Service Specific |
Payment Solutions service |
Opayo |
IQR Consulting, LLC |
Service Specific |
Consulting services |
EMS |
Iron Mountain Information Management LLC |
Service Specific |
Warehouse record storage |
EMS Opayo |
Krajowy Integrator Płatności SA |
Service Specific |
Payment gateway services |
EMS |
Microsoft Corporation |
Infrastructure |
Cloud infrastructure |
EMS Opayo |
Nets Branch Norway |
Service Specific |
Payment processing services |
EMS |
Network merchants Limited |
Service Specific |
Payment gateway services |
EMS |
NTT Data Services, LLC |
Service Specific |
Service desk support services |
EMS Opayo |
Oasis Document and Data Management Limited |
Service Specific |
Document management services |
EMS |
Oracle America, Inc. |
Optional Integrations |
Hospitality software solution services |
EMS Opayo |
Pay & Shop Limited t/a Global Payments |
Service Specific |
Payment gateway services |
EMS |
Payone GmbH |
Service Specific |
Distribution service payment transactions |
EMS |
Poynt, LLC |
Optional Integrations |
Cloud-based payment services |
EMS |
PPRO Financial Ltd |
Optional Integrations |
Alternative payment services |
EMS Opayo |
Qualtrics, LLC |
Service Specific |
Customer research services |
EMS |
Quest Software Inc. |
Service Specific |
Cloud-based user access authentication software services |
EMS Opayo |
Salesforce.com, Inc. |
Service Specific |
Cloud-based customer support & communication services |
EMS Opayo |
Sumo Logic, Inc. |
Service Specific |
Security operations log management and analytics services |
Opayo |
Transaction Network Services, Inc. |
Service Specific |
Payment network transaction services |
EMS Opayo |
TransPerfect Global, Inc. |
Service Specific |
Translation services |
EMS |
Twilio Inc. and SendGrid, Inc. |
Service Specific |
Cloud-based enail communication services |
Opayo |
Wipro Limited |
Service Specific |
Contracting, development, and testing resources for software applications |
Opayo |
Amazon Web Services, Inc.
Infrastracture
Service Specific
Cloud Infrasctucutre Provider and application service provider
EMS
Opayo
BT Communications Ireland Limited
Infrastructure
Data centre service provider
EMS
Opayo
CCV Group B.V.
Service Specific
Payment transaction routing service
EMS
Computop Paygate GmbH
Service Specific
Payment processing services
EMS
DataFlexNet Ltd
Service Specific
Payment transaction routing service
EMS
Digital London Limited
Infrastructure
Data centre service provider
Opayo
Equens Worldline SE
Service Specific
Payment transaction routing service
EMS
Equinix Inc.
Infrastructure
Data centre service provider
EMS
Opayo
Evry Norge AS
Service Specific
Payment network transaction services
EMS
Featurespace Inc.
Service Specific
Fraud software services
EMS
Opayo
Fexco Merchant Services
Service Specific
Partner to provide currency conversion services
EMS
Opayo
Finastra Technology Inc.
Service Specific
Software solution services
EMS
FreedomPay World Europe Limited
Service Specific
Payment solutions service
EMS
Futurex, LP
Service Specific
Payment Solutions service
Opayo
IQR Consulting, LLC
Service Specific
Consulting services
EMS
Iron Mountain Information Management LLC
Service Specific
Warehouse record storage
EMS
Opayo
Krajowy Integrator Płatności SA
Service Specific
Payment gateway services
EMS
Microsoft Corporation
Infrastructure
Cloud infrastructure
EMS
Opayo
Nets Branch Norway
Service Specific
Payment processing services
EMS
Network merchants Limited
Service Specific
Payment gateway services
EMS
NTT Data Services, LLC
Service Specific
Service desk support services
EMS
Opayo
Oasis Document and Data Management Limited
Service Specific
Document management services
EMS
Oracle America, Inc.
Optional Integrations
Hospitality software solution services
EMS
Opayo
Pay & Shop Limited t/a Global Payments
Service Specific
Payment gateway services
EMS
Payone GmbH
Service Specific
Distribution service payment transactions
EMS
Poynt, LLC
Optional Integrations
Cloud-based payment services
EMS
PPRO Financial Ltd
Optional Integrations
Alternative payment services
EMS
Opayo
Qualtrics, LLC
Service Specific
Customer research services
EMS
Quest Software Inc.
Service Specific
Cloud-based user access authentication software services
EMS
Opayo
Salesforce.com, Inc.
Service Specific
Cloud-based customer support & communication services
EMS
Opayo
Sumo Logic, Inc.
Service Specific
Security operations log management and analytics services
Opayo
Transaction Network Services, Inc.
Service Specific
Payment network transaction services
EMS
Opayo
TransPerfect Global, Inc.
Service Specific
Translation services
EMS
Twilio Inc. and SendGrid, Inc.
Service Specific
Cloud-based enail communication services
Opayo
Wipro Limited
Service Specific
Contracting, development, and testing resources for software applications
Opayo
Notice: Subject to change at any time. Last updated on August 31st, 2023.