Common use of Data Transfers to Third Countries Clause in Contracts

Data Transfers to Third Countries. 7.1 If the Processor processes EU, UK or Swiss Personal Data at or from its facilities in a third country as a data controller located in the EU, UK or Switzerland (“European Territories”), the Standard Contractual Clauses shall be incorporated by reference in this DPA. The parties agree that Processor is the data importer and Controller is the data exporter. Unless otherwise agreed by the parties, Exhibits A and B of this DPA shall apply to the Standard Contractual Clauses, and for the purpose of clauses 9 and 11(3) of the Standard Contractual Clauses, the governing law will be the country in which the relevant Controller is established. Nothing in this DPA shall be construed to prevail over any conflicting clause of the Standard Contractual Clauses. Each party acknowledges that it has had the opportunity to review the Standard Contractual Clauses. In particular, the Processor acknowledges its obligations: (i) under clause 5(a) of the Standard Contractual Clauses to promptly inform the Controller of the Processor’s inability to comply with the Standard Contractual Clauses; (ii) under clause 5(d)(i) of the Standard Contractual Clauses to notify the Controller of a legally binding request for disclosure by a law enforcement authority; and (iii) under clause 5(e) of the Standard Contractual Clauses to deal promptly and properly with all inquiries from the Controller relating to the processing which is the subject of the transfer. 7.2 For the avoidance of doubt, in the event that the European Commission approves a successor set of controller to processor Standard Contractual Clauses (“New SCCs”), or the UK authorities issue a set of controller to processor Standard Contractual Clauses (“UK SCCs”), the New SCCs and the UK SCCs shall be incorporated by reference in this DPA in place of the previously approved set of Standard Contractual Clauses. In such cases, the information set out in Exhibits A and B of this DPA shall be deemed to be incorporated into the appropriate sections of the New SCCs and the UK SCCs, and the Processor acknowledges the equivalent obligations in the New SCCs and UK SCCs as those set out above. To the extent that the New SCCs or UK SCCs require the inclusion of additional information not covered by Exhibits A and B of this DPA, the Controller may incorporate that additional information into the New SCCs and UK SCCs by way of a written notice to the Processor. 7.3 This section applies if the Processor is established in the European Territories and engages a Sub-Processor in a third country to process EU, Swiss or UK Personal Data. In this situation, the Processor will assist the Controller and its Affiliates based in the European Territories and/or that process Personal Data of data subjects in the European Territories to adduce an adequate level of protection for EU, Swiss or UK Personal Data by executing Standard Contractual Clauses with that Sub-Processor on the Controller’s behalf. The Controller hereby appoints Processor as its agent for the sole purpose of entering into such Standard Contractual Clauses on the Controller’s behalf. The Processor shall provide the Controller with a copy of any Standard Contractual Clauses entered into pursuant to this section promptly on request. 7.4 If, for whatever reason, the transfer of EU, Swiss or UK Personal Data under the above Standard Contractual Clauses ceases to be lawful, the Controller may, at its discretion: (i) require Processor to cease transfers of such Personal Data to, or access to such data from, the relevant jurisdictions; or (ii) require the Processor to promptly cooperate with the Controller to facilitate the Controller’s use of an alternative lawful data transfer mechanism that will permit the Controller and its Affiliates established in the European Territories and/or that process Personal Data of individuals in the European Territories to continue to benefit from the Services in compliance with Data Protection Law. If the Controller and Processor are unable to promptly enter into such an alternative data transfer mechanism, then either party may (at its option) terminate the Agreement or reduce the scope of the processing of Personal Data to exclude EU, Swiss or UK Personal Data.