Let's say that company X is PCI certified and compliant as a merchant. In terms of PCI compliance, what does company X have to consider while working with third parties? E.g. for business reasons company X needs to forward hashed PAN numbers to a third-party provider. What does company X have to do in order not to violate PCI compliance?