Common use of Transfers Outside of the EU Clause in Contracts

Transfers Outside of the EU. During the provision of Services under the DPA, it may be necessary for Controller to transfer Personal Data from the European Union, the European Economic Area and/or their member states, the United Kingdom, or Switzerland to Processor in a country that does not have an adequacy decision from the European Commission or is not located in the European Economic Area. In the event of such a transfer, the Standard Contractual Clauses apply as follows: 9.1.1. In relation to Personal Data that is subject to the GDPR (i) Processor will be deemed the “data importer” and Controller is the “data exporter”; (ii) the Module Two terms shall apply where Controller is a Data Controller and where Processor is a Data Processor; (iii) in Clause 7, the optional docking clause shall be deleted; (iv) in Clause 9 of Module Two, Option 2 shall apply and the list of Sub-processors and time period for notice of changes shall be as agreed under Section 5 of this DPA; (v) in Clause 11, the optional language shall be deleted; (vi) in Clause 17, Option 1 shall apply and the Standard Contractual Clauses shall be governed by the member state where Controller is domiciled; (vii) in Clause 18(b), disputes shall be resolved before the courts of the member state where Controller is domiciled; (viii) Annex I and Annex II shall be deemed completed with the information set out in Schedule 1 of this DPA respectively; and (ix) if and to the extent the Standard Contractual Clauses conflict with any provision of the Agreement (including this DPA) the Standard Contractual Clauses shall prevail to the extent of such conflict. For this section, the Standard Contractual Clauses from the Commission Implementing Decision (EU) 2021/914 are incorporated by reference and available here: xxxxx://xx.xxxxxx.xx/info/law/law-topic/data- protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard- contractual-clauses-international-transfers_en. 9.1.2. In relation to Personal Data that is subject to UK Data Protection Laws, the Standard Contractual Clauses shall apply with the following modifications (i) the contact information about the parties to this Agreement is the contact information for the UK Standard Contractual Clauses (“UK SCCs”); (ii) Controller is the data exporter and Processor is the data importer; (iii) Clause 9 will state, “The laws of England and Wales"; (iv) the Parties do not use the additional commercial clauses; and (v) the information in this Agreement and Schedule 1 can be used to answer the questions from Appendix 1 and 2. For this section, the Standard Contractual Clauses from the Information Commissioner’s Office are incorporated by reference and available here: xxxxx://xxx.xxx.xx/for-organisations/guide- to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data- transfer-agreement-and-guidance/. 9.1.3. In relation to Personal Data that is subject to the Swiss DPA, the Standard Contractual Clauses referenced in Section 9.1.1 shall apply with the following modifications (i) references to "Regulation (EU) 2016/679" shall be interpreted as references to the Swiss DPA; (ii) references to "EU", "Union" and "Member State law" shall be interpreted as references to Swiss law; and (iii) references to the "competent supervisory authority" and "competent courts" shall be replaced with the "the Swiss Federal Data Protection and Information Commissioner " and the "relevant courts in Switzerland".

Transfers Outside of the EU. During the provision of Services under the DPA, it may be necessary for Controller Xxxxxx to transfer Personal Data from the European Union, the European Economic Area and/or their member states, the United Kingdom, or Switzerland to Processor in a country that does not have an adequacy decision from the European Commission or is not located in the European Economic Area. In the event of such a transfer, the Standard Contractual Clauses apply as follows: 9.1.1. In relation to Personal Data that is subject to the GDPR (i) Processor will be deemed the “"data importer” " and Controller Ivanti is the “"data exporter”"; (ii) the Module Two terms shall apply where Controller Xxxxxx is a Data Controller and where Processor is a Data Processor; (iii) in Clause 7, the optional docking clause shall be deleted; (iv) in Clause 9 of Module Two, Option 2 shall apply and the list of Sub-processors Subprocessors and time period for notice of changes shall be as agreed under Section 5 of this DPA; (v) in Clause 11, the optional language shall be deleted; (vi) in Clause 17, Option 1 shall apply and the Standard Contractual Clauses shall be governed by the member state where Controller Xxxxxx is domiciled; (vii) in Clause 18(b), disputes shall be resolved before the courts of the member state where Controller Xxxxxx is domiciled; (viii) Annex I and Annex II shall be deemed completed with the information set out in Schedule 1 of this DPA respectively; and (ix) if and to the extent the Standard Contractual Clauses conflict with any provision of the Agreement (including this DPA) the Standard Contractual Clauses shall prevail to the extent of such conflict. For this section, the Standard Contractual Clauses from the Commission Implementing Decision (EU) 2021/914 are incorporated by reference and available here: xxxxx://xx.xxxxxx.xx/info/law/law-topic/data- protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard- contractual-clauses-international-transfers_enxxxxx://xx.xxxxxx.xx/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en. 9.1.2. In relation to Personal Data that is subject to UK Data Protection Laws, the Standard Contractual Clauses International Data Transfer Agreement (“IDTA”) shall apply with the following modifications modifications: (i) the contact information about the parties to this the Agreement is the contact information for the UK Standard Contractual Clauses (“UK SCCs”)IDTA; (ii) Controller Ivanti is the data exporter and Processor is the data importer; (iii) Clause 9 will state, “The the laws of that govern the IDTA and the location where legal claims can be made is England and Wales"; (iv) the UK GDPR does not apply to the data importer’s processing of transferred data; (v) the Parties do not use the additional security or commercial clausesclauses from the IDTA; and (vvi) the information in this Agreement DPA and Schedule 1 can be used to answer the questions from Appendix 1 and 2for Tables 1-4. For this section, the Standard Contractual Clauses from the Information Commissioner’s Office are incorporated by reference and available here: xxxxx://xxx.xxx.xx/for-organisations/guide- to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data- transfer-agreement-and-guidance/.xxxxx://xxx.xxx.xx/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data-transfer-agreement-and-guidance/. 9.1.3. In relation to Personal Data that is subject to the Swiss DPA, the Standard Contractual Clauses referenced in Section 9.1.1 shall apply with the following modifications (i) references to "Regulation (EU) 2016/679" shall be interpreted as references to the Swiss DPA; (ii) references to "EU", "Union" and "Member State law" shall be interpreted as references to Swiss law; and (iii) references to the "competent supervisory authority" and "competent courts" shall be replaced with the "the Swiss Federal Data Protection and Information Commissioner " and the "relevant courts in Switzerland".

Transfers Outside of the EU. During In the course of the provision of Services under the DPA, it may be necessary for Controller to transfer Personal Data from the European Union, the European Economic Area and/or their member states, Switzerland, or the United Kingdom, or Switzerland to Processor in a country that does not have an adequacy decision from the European Commission or is not located in the European Economic Area. In the event of such a transfer, the Standard Contractual Clauses apply as follows:. 1.2 9.1.1. In relation to Personal Data that is subject to the GDPR (i) Processor will be deemed the “"data importer” " and Controller is the “"data exporter”"; (ii) the Module Two terms shall apply where Controller is a Data Controller and where Processor is a Data Processor; (iii) in Clause 7, the optional docking clause shall be deleted; (iv) in Clause 9 of Module Two, Option 2 shall apply and the list of Sub-processors Subprocessors and time period for notice of changes shall be as agreed under Section 5 of this DPA; (v) in Clause 11, the optional language shall be deleted; (vi) in Clause 17, Option 1 shall apply and the Standard Contractual Clauses shall be governed by the member state where Controller is domiciled; (vii) in Clause 18(b), disputes shall be resolved before the courts of the member state where Controller is domiciled; (viii) Annex I and Annex II shall be deemed completed with the information set out in Schedule 1 of this DPA respectively; and (ix) if and to the extent the Standard Contractual Clauses conflict with any provision of the Agreement (including this DPA) the Standard Contractual Clauses shall prevail to the extent of such conflict. For this section, the Standard Contractual Clauses from the Commission Implementing Decision (EU) 2021/914 are incorporated by reference and available here: xxxxx://xx.xxxxxx.xx/info/law/law-topic/data- protection/international-dimension-data-protection/standard-xxxxx://xx.xxxxxx.xx/info/law/law-topic/data-protection/international-dimension-data-protection/standard- contractual-clauses-scc/standard- standard-contractual-clauses-international-transfers_en. 1.3 9.1.2. In relation to Personal Data that is subject to UK Data Protection Laws, the Standard Contractual Clauses International Data Transfer Agreement (“IDTA”) shall apply with the following modifications modifications: (i) the contact information about the parties to this the Agreement is the contact information for the UK Standard Contractual Clauses (“UK SCCs”)IDTA; (ii) Controller is the data exporter and Processor is the data importer; (iii) Clause 9 will state, “The the laws of that govern the IDTA and the location where legal claims can be made is England and Wales"; (iv) the UK GDPR does not apply to the data importer’s processing of transferred data; (v) the Parties do not use the additional security or commercial clausesclauses from the IDTA; and (vvi) the information in this Agreement DPA and Schedule 1 can be used to answer the questions from Appendix 1 and 2for Tables 1-4. For this section, the Standard Contractual Clauses from the Information Commissioner’s Office are incorporated by reference and available here: xxxxx://xxx.xxx.xx/for-organisations/guide- to-data-protection/guide-to-the-general-data-protection-xxxxx://xxx.xxx.xx/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection- regulation-gdpr/international-data- data-transfer-agreement-and-guidance/. 1.4 9.1.3. In relation to Personal Data that is subject to the Swiss DPA, the Standard Contractual Clauses referenced in Section 9.1.1 shall apply with the following modifications (i) references to "Regulation (EU) 2016/679" shall be interpreted as references to the Swiss DPA; (ii) references to "EU", "Union" and "Member State law" shall be interpreted as references to Swiss law; and (iii) references to the "competent supervisory authority" and "competent courts" shall be replaced with the "the Swiss Federal Data Protection and Information Commissioner " and the "relevant courts in Switzerland".