MODULE TWO. Transfer controller to processor
MODULE TWO. To the extent that Customer acts as data controller and Billtrust acts as data processor, Customer (which will take on the obligations of “data exporter” for the purposes of the Standard Contractual Clauses) and Billtrust (which will take on the obligations of “data importer” for the purposes of the Standard Contractual Clauses) hereby enter into, the Standard Contractual Clauses (including their additional constituent elements, as set out in Exhibit A to this Addendum, as applicable), which are incorporated by this reference and constitute part of this Addendum as follows:
i. Module Two will apply;
ii. in Clause 7, the optional docking Clause will not apply;
iii. in Clause 9, Option 2 will apply, and the time period for prior notice of sub-Processor changes shall be as set out in clause 4.3 of Module 2 of this Addendum;
iv. in Clause 11, the optional language will not apply;
v. in Clause 17, Option 1 will apply, and the EU SCCs will be governed by the laws that apply pursuant to Section 8.7 of the Terms;
vi. in Clause 18(b), disputes shall be resolved before the courts that are competent pursuant to Section 8.7 of the Terms;
vii. in Annex I: - Part A: with the information set out in the heading and Exhibit A to this Addendum; - Part B: with the relevant Processing Annex(ures) set out in Exhibit A to this Addendum; and - Part C: in accordance with the criteria set out in Clause 13(a) of the EU SCCs;
viii. Xxxxx XX: with the Security Measures set out in Exhibit A to this Addendum.
MODULE TWO. Clause 8.1(b), 8.9(a), (c), (d) and (e); Module Three: Clause 8.1(a), (c) and (d) and Clause 8.9(a), (c), (d), (e), (f) and (g); Module Four: Clause 8.1 (b) and Clause 8.3(b);
MODULE TWO. Controller-Processor
MODULE TWO. The EU Standard Contractual Clauses shall be governed by the Module Two (Transfer controller to processor) clauses in all applicable instances, and the Client and/or the Client’s EU affiliates shall be the data exporter and K2 shall be the data importer.
MODULE TWO. Transfer controller to processor MODULE THREE: Transfer processor to processor
(a) Where the data exporter is established in an EU Member State: The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.
