Annex 2

European Annex

DATA PROTECTION IMPACT ASSESSMENT AND PRIOR CONSULTATION

Taking into account the nature of the Processing of Customer Personal Data by Service Provider and the information available to Service Provider, Service Provider shall provide reasonable assistance to Customer, at Customer's cost, with any data protection impact assessments and prior consultations with Supervisory Authorities which Customer reasonably considers to be required of it by Article 35 or Article 36 of the GDPR, in each case solely in relation to Processing of Customer Personal Data by Service Provider.

RESTRICTED TRANSFERS
EEA Restricted Transfers
  1. To the extent that any Processing of Customer Personal Data under this DPA involves an EEA Restricted Transfer from Customer to Service Provider, the Parties shall comply with their respective obligations set out in the EU SCCs, which are hereby deemed to be:
    1. populated in accordance with Part 1 of Attachment 1 to this Annex 2 (European Annex); and
    2. entered into by the Parties and incorporated by reference into this DPA.
UK Restricted Transfers
  1. To the extent that any Processing of Customer Personal Data under this DPA involves a UK Restricted Transfer from Customer to Service Provider, the Parties shall comply with their respective obligations set out in the UK SCCs, which are hereby deemed to be:
    1. The EU SCCs as varied to address the requirements of the UK GDPR in accordance with the UK Transfer Addendum and populated in accordance with Part 2 of Attachment 1 to this Annex 2 (European Annex); and
    2. entered into by the Parties and incorporated by reference into this DPA.
Adoption of new transfer mechanism
  1. Service Provider may on notice vary this DPA and replace the relevant SCCs with:
    1. any new form of the relevant SCCs or any replacement therefor prepared and populated accordingly (e.g., standard data protection clauses adopted by the European Commission for use specifically in respect of transfers to data importers subject to Article 3(2) of the EU GDPR); or
    2. another transfer mechanism, that enables the lawful transfer of Customer Personal Data by Customer to Service Provider under this DPA in compliance with Chapter V of the GDPR.
Provision of full-form SCCs
  1. In respect of any given Restricted Transfer, if requested of Customer by a Supervisory Authority, Data Subject or further Controller (where applicable) – on specific written request (made to the contact details set out in Annex 1 (Data Processing Details); accompanied by suitable supporting evidence of the relevant request), Service Provider shall provide Customer with an executed version of the relevant set(s) of SCCs responsive to the request made of Customer (amended and populated in accordance with Attachment 1 to this Annex 2 (European Annex) in respect of the relevant Restricted Transfer) for countersignature by Customer, onward provision to the relevant requestor and/or storage to evidence Customer's compliance with Applicable Privacy Laws.
Supplementary Measures
  1. As of the date of this DPA, Service Provider has not received any formal legal requests from any government intelligence or security service/agencies in the country to which the Customer Personal Data is being exported, for access to (or for copies of) Customer's Personal Data ("Government Agency Requests")
  2. If, after the date of this DPA, Service Provider receives any Government Agency Requests, Service Provider shall attempt to redirect the law enforcement or government agency to request that data directly from Customer. As part of this effort, Service Provider may provide Customer's basic contact information to the government agency. If compelled to disclose Customer's Personal Data to a law enforcement or government agency, Service Provider shall give Customer reasonable notice of the demand and cooperate to allow Customer to seek a protective order or other appropriate remedy unless Service Provider is legally prohibited from doing so. Service Provider shall not voluntarily disclose Customer Personal Data to any law enforcement or government agency. Customer and Service Provider shall (as soon as reasonably practicable) discuss and determine whether all or any transfers of Personal Data pursuant to this DPA should be suspended in the light of the such Government Agency Requests.
  3. Customer and Service Provider will meet as needed to consider whether:
    1. the protection afforded by the laws of the country of the Service Provider to Data Subjects whose Personal Data is being transferred is sufficient to provide broadly equivalent protection to that afforded in the EEA or the UK, whichever the case may be;
    2. additional measures are reasonably necessary to enable the transfer to be compliant with the Applicable Privacy Laws; and
    3. it is still appropriate for Customer Personal Data to be transferred to the relevant Service Provider, taking into account all relevant information available to the parties, together with guidance provided by the Supervisory Authorities.
OPERATIONAL CLARIFICATIONS
  1. When complying with its transparency obligations under Clause 8.3 of the EU SCCs, Customer agrees that it shall not provide or otherwise make available, and shall take all appropriate steps to protect Service Provider's and its licensors' trade secrets, business secrets, Confidential Information and/or other commercially sensitive information.
  2. Where applicable, for the purposes of Clause 10(a) of Module Two of the EU SCCs, Customer acknowledges and agrees that there are no circumstances in which it would be appropriate for Service Provider to notify any third-party controller of any Data Subject Request and that any such notification shall be the sole responsibility of Customer.
  3. For the purposes of Clause 15.1(a) of the EU SCCs, except to the extent prohibited by applicable law and/or the relevant public authority, as between the Parties, Customer agrees that it shall be solely responsible for making any notifications to relevant Data Subject(s) if and as required.
  4. The terms and conditions of Section 8 of this DPA apply in relation to Service Provider's appointment and use of Sub-processors under the EU SCCs. Any approval by Customer of Service Provider's appointment of a Sub-processor that is given expressly or deemed given pursuant to Section 8 constitutes Customer's documented instructions to effect disclosures and onward transfers to any relevant Sub-processors if and as required under Clause 8.8 of the EU SCCs.
  5. The audits described in Clauses 8.9(c) and 8.9(d) of the EU SCCs shall be subject to any relevant terms and conditions detailed in Section 9 of this DPA.
  6. Certification of deletion of Customer Personal Data as described in Clauses 8.5 and 16(d) of the EU SCCs shall be provided only upon Customer's written request.

ATTACHMENT 1 TO EUROPEAN ANNEX

POPULATION OF SCCs

Notes:

  • In the context of any EEA Restricted Transfer, the EU SCCs populated in accordance with Part 1 of this Attachment 1 are incorporated by reference into and form an effective part of the DPA (if and where applicable in accordance with Paragraph 2.1 of Annex 2 (European Annex) to the DPA).
  • In the context of any UK Restricted Transfer, the UK SCCs (i.e. the EU SCCs as varied by the UK Transfer Addendum and populated in accordance with Part 2 of this Attachment 1) are incorporated by reference into and form an effective part of the DPA (if and where applicable in accordance with Paragraph 2.2 of Annex 2 (European Annex) to the DPA).

PART 1: POPULATION OF THE SCCs – EU SCCs

SIGNATURE OF THE EU SCCs

Where the EU SCCs apply in accordance with Paragraph 2.1 of Annex 2 (European Annex) to the DPA, (a) each of the Parties is hereby deemed to have signed the EU SCCs at the relevant signature block in Annex I to the Appendix to the EU SCCs; and (b) those EU SCCs are entered into by and between the Parties with effect from (i) the Addendum Effective Date; or (ii) the date of the first EEA Restricted Transfer to which they apply in accordance with Paragraph 2.1 of Annex 2 (European Annex) to the DPA, whichever is earlier.

MODULES

The following module of the EU SCCs apply in the manner set out below (having regard to the role(s) of Customer set out in Annex 2 (European Annex) to the DPA): Module Two of the EU SCCs applies to any EEA Restricted Transfer involving Processing of Customer Personal Data in respect of which Customer is a Controller in its own right.

POPULATION OF THE BODY OF THE EU SCCs
  1. For Module Two of the EU SCCs, the following applies as and where applicable to that Module and the Clauses thereof:
    1. The optional 'Docking Clause' in Clause 7 is not used and the body of that Clause 7 is left intentionally blank.
    2. In Clause 9:
      1. OPTION 2: GENERAL WRITTEN AUTHORISATION applies, and the minimum time period for advance notice of the addition or replacement of Sub-Processors shall be the advance notice period set out in Section 8 of the DPA; and
      2. OPTION 1: SPECIFIC PRIOR AUTHORISATION is not used and that optional language is deleted; as is, therefore, Annex III to the Appendix to the EU SCCs.
    3. In Clause 11, the optional language is not used and is deleted.
    4. In Clause 13, all square brackets are removed and all text therein is retained.
    5. In Clause 17: OPTION 1 applies, and the Parties agree that the EU SCCs shall be governed by the law of Ireland in relation to any EEA Restricted Transfer; and OPTION 2 is not used and that optional language is deleted.
    6. For the purposes of Clause 18, the Parties agree that any dispute arising from the EU SCCs in relation to any EEA Restricted Transfer shall be resolved by the courts of Ireland, and Clause 18(b) is populated accordingly.
  2. In this Paragraph 3, references to "Clauses" are references to the Clauses of the EU SCCs.
POPULATION OF ANNEXES TO THE APPENDIX TO THE EU SCCs
  1. Annex I to the Appendix to the EU SCCs is populated with the corresponding information detailed in Annex 1 (Data Processing Details) to the DPA, with: Customer being 'data exporter'; and Service Provider being 'data importer'.
  2. Part C of Annex I to the Appendix to the EU SCCs is populated as below:
    1. Where Customer is established in an EU Member State, the competent supervisory authority shall be the supervisory authority of that EU Member State in which Customer is established.
    2. Where Customer is not established in an EU Member State, Article 3(2) of the EU GDPR applies and Customer has appointed an EU representative under Article 27 of the EU GDPR: the competent supervisory authority shall be the supervisory authority of the EU Member State in which Customer's EU representative relevant to the processing hereunder is based (from time-to-time).
    3. Where Customer is not established in an EU Member State, Article 3(2) of the EU GDPR applies, but Customer has not appointed an EU representative under Article 27 of the EU GDPR: the competent supervisory authority shall be the supervisory authority of the EU Member State notified in writing to Service Provider's contact point for data protection identified in Annex 1 (Data Processing Details) to the DPA, which must be an EU Member State in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located.
  3. Annex II to the Appendix to the EU SCCs is populated as below:

    General:

    • Please refer to Section 7 of the DPA and the Security Measures described therein.
    • In the event that Customer receives a Data Subject Request under the EU GDPR and requires assistance from Service Provider, Customer should email Service Provider's contact point for data protection identified in Annex 1 (Data Processing Details) to the DPA.

    Sub-Processors:

    When Service Provider engages a Sub-Processor under these Clauses, Service Provider shall enter into a binding contractual arrangement with such Sub-Processor that imposes upon them data protection obligations which, in substance, meet or exceed the relevant standards required under these Clauses and the DPA – including in respect of:

    • applicable information security measures;
    • notification of Personal Data Breaches to Service Provider;
    • return or deletion of Customer Personal Data as and where required; and
    • engagement of further Sub-Processors.

PART 2: UK RESTRICTED TRANSFERS – UK SCCs

UK TRANSFER ADDENDUM
  1. Where relevant in accordance with Paragraph 2.2 of Annex 2 (European Annex) to the DPA, the EU SCCs also apply in the context of UK Restricted Transfers as varied by the UK Transfer Addendum (UK SCCs) in the manner described below –
    1. Part 1 to the UK Transfer Addendum. The Parties agree:
      1. Tables 1, 2 and 3 to the UK Transfer Addendum are deemed populated with the corresponding details set out in Annex 1 (Data Processing Details) to the DPA and the foregoing provisions of this Annex 2 (European Annex) (subject to the variations effected by the UK Mandatory Clauses described in (b) below); and
      2. Table 4 to the UK Transfer Addendum is completed by the box labelled 'Data Importer' being deemed to have been ticked.
    2. Part 2 to the UK Transfer Addendum. The Parties agree to be bound by the UK Mandatory Clauses of the UK Transfer Addendum.
  2. As permitted by Section 17 of the UK Mandatory Clauses, the Parties agree to the presentation of the information required by 'Part 1: Tables' of the UK Transfer Addendum in the manner set out in Paragraph 1.1 of this Part 2; provided that the Parties further agree that nothing in the manner of that presentation shall operate or be construed so as to reduce the Appropriate Safeguards (as defined in Section 3 of the UK Mandatory Clauses).
  3. In relation to any UK Restricted Transfer to which they apply, where the context permits and requires, any reference in the DPA to the SCCs, shall be read as a reference to those SCCs as varied in the manner set out in Paragraph 1.1 of this Part 2.