Transfers Outside the European Economic Area. 7.1 The Parties agree that the Standard Contractual Clauses (as evidence by each party’s authorized signature on the Agreement), will apply to Customer Data that is transferred outside the EEA, either directly or via onward transfer, to any country not recognized by the European Commission as providing as adequate level of protection for personal data (as described by the GDPR.
Transfers Outside the European Economic Area. The Controller has given the Processor specific permission for the following transfers to third countries or international organisations (to be completed by the Controller). Transfer description Entity transferring the Entity receiving the Transfer Additional Personal Data + Personal Data + mechanism safeguards country country implemented for transfers outside the EEA Contact information General contact information Name Job title E-mail address Telephone number The Controller (To be completed by the Controller) The Processor Contact information in the event of a Personal Data Breach Name Job title E-mail address Telephone number The Controller (to be completed by the Controller) The Processor Annex B: Security measures Version No XX, Date of latest amendment: XX-XX-XX Details of the security measures taken by the Processor: Certificates held by the Processor:
Transfers Outside the European Economic Area. 7.1 Privacy Shield. Humanity complies with the terms of the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks, and is Privacy Shield certified. That certification will serve as the transfer mechanisms for any Customer transfers of Customer Data under this DPA to Humanity from the EEA, Switzerland or the United Kingdom to the United States. The Parties acknowledge and agree that on the request of the United States Department of Commerce (or any successor body) or a competent supervisory authority, enforcement or other public or regulatory authority, court or tribunal, Humanity may make available to them a summary or representative copy of this DPA or any relevant provisions in the Agreement.
Transfers Outside the European Economic Area. 8.1 Your Data may be transferred to entities located in other countries, including outside the European Economic Area (“EEA”). These other countries may either have different data protection laws than your country of residence or they may not have data protection laws. Steps will however be taken to put in place safeguards (including around security) to protect your Data when it is in other countries. For example, in respect of Europe, this includes use of European Model Clause contracts. You can find out what these are online at the following address: xxxx://xx.xxxxxx.xx/justice/data- protection/international-transfers/transfer/index_en.htm. If you have any questions or wish to be provided with a copy please see “Contact Us” for further contact information. Please note commercially sensitive information may be removed/blanked out from copies supplied to you.)
Transfers Outside the European Economic Area. The Controller has given the Processor specific permission for the following transfers to third parties or international organisations (to be completed by the Controller). Transfer description Entity transferring the Personal Data + country Entity receiving the Personal Data + country Transfer mechanism Additional safeguards implemented for transfers outside the EEA Contact details General contact person: Controller Name: <to be completed> Position: <to be completed> Email address: <to be competed> Telephone number: <to be completed> Processor: Name: <to be completed> Position: <to be completed> Email address: <to be completed> Telephone number: <to be completed> If a (suspicion of a) Personal Data Breach occurs, the Processor shall inform the General Controller’s contact person as well as the Controller’s Data protection officer. Data protection officer (DPO): Controller: Name: M.R.G. Xxxxxxxxxx Position: DPO Email address: xx@xxxxxxxxxxxxxxxxx.xxx Telephone number: +00 00 000 0000 Telephone number outside office hours/in emergency (through the Computer Emergency Response Team): +00 00 000 0000 Processor: Name: <to be completed> Position: <to be completed> Email address: <to be completed> Telephone number: <to be completed> Telephone number outside office hours / in emergency: <to be completed> Annex B: Security Measures Version number XX, Date of most recent update: XX-XX-XX The Processor describes the security measures implemented. The Controller will verify if these measures comply with the Guidelines for Security Measures (appendix to the SURF Framework of Legal Standards for (Cloud) Services) and the Security Technical IT Checklist (STITCH). The Processor proves by submitting an IT Security report from an independent tester that the STITCH requirements have been met. For the testing of the technical and organizational security measures, the internal Procedure Security Check is followed.3 The assessment of the test is recorded in this Annex under a. To do this, the CISO Office needs: - CIA classification - ISO 27001 certification - Statement of Applicability to the ISO 27001 certification Or - A SURF framework of standards completed by the supplier if there is no ISO certification. The IT Security Office needs: Pentest report - This is mandatory when the CIA rating scores medium or high on integrity and/or confidentiality. The pentest must not be older than one year. Or STITCH - If the CIA classification scores low and there is no pentest report, a co...
