An entity, other than a card brand, that is directly involved in the processing, storage, or transmission of cardholder data on behalf of another entity. This includes entities that provide services that could impact the security of cardholder data.