Common use of TRANSFERS TO THIRD COUNTRIES Clause in Contracts

TRANSFERS TO THIRD COUNTRIES. The Processor may not transfer personal data outside the EU/EEA, or engage a Sub- Processor to process personal data outside of the EU/EEA, without at least one of the following prerequisites fulfilled: (i) the receiving country has an adequate level of protection of personal data as decided by the European Commission, (ii) the transfer is subject to the European Commission’s Standard Contractual Clauses for transfer of personal data to third countries, or (iii) the Sub-Processor is subject to Binding Corporate Rules and the receiving party in the third country is also subject to the Binding Corporate Rules.

TRANSFERS TO THIRD COUNTRIES. 8.1. The Processor may shall, as a main principle, not intentionally, nor unintentionally transfer personal data outside the EU/EEA. 8.2. However, or engage a Sub- Processor to process in some cases, the use of certain services, despite what is stated above, could entail processing of personal data outside of the EU/EEA. If Refined and/or Sub-processors transfers personal data outside the EU/EEA, without at least one of such transfer shall always, as far as possible, comply with the following prerequisites fulfilled: (i) the receiving country has an adequate level of applicable data protection of personal data as decided by the European Commission, (ii) the transfer is subject re- quirements according to the European Commission’s Standard Contractual Clauses for transfer of personal data to third countries, or (iii) the Sub-Processor is subject to Binding Corporate Rules and the receiving party in the third country is also subject to the Binding Corporate RulesGDPR.

TRANSFERS TO THIRD COUNTRIES. The Processor may not transfer personal data outside the EU/EEA, or engage a Sub- Sub-Processor to process personal data outside of the EU/EEA, without at least one of the following prerequisites is fulfilled: (i) the receiving country has an adequate level of protection of personal data as decided by the European Commission, (ii) the transfer is subject to the European Commission’s Standard Contractual Clauses for transfer of personal data to third countries, or (iii) the Sub-Processor is subject to Binding Corporate Rules and the receiving party in the third country is also subject to the Binding Corporate Rules.