(Attachment to the SantaClues Data Processing Agreement)
This document incorporates the Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914.
The SCCs apply where personal data processed under the SantaClues Services is transferred to a third country without an adequacy decision.
This attachment forms part of the Data Processing Agreement (DPA) between:
Controller: Customer using the SantaClues Services
Processor: SantaClues AS
The following modules apply depending on the roles of the parties.
Applies to transfers where:
Controller (Customer)
→ transfers personal data →
SantaClues (Processor)
This module governs the transfer of personal data to SantaClues when SantaClues processes personal data on behalf of the Controller in connection with the Services.
Applies to transfers where:
SantaClues (Processor)
→ transfers personal data →
Subprocessors engaged to provide the Services.
This module governs onward transfers to subprocessors used by SantaClues.
The following SCC clause options are selected.
Included.
The docking clause permits additional controllers or processors to accede to the SCCs as parties where required.
Option 2 — General Authorisation
SantaClues has general authorisation to engage subprocessors, subject to the notification and objection mechanism described in the Data Processing Agreement.
The list of authorised subprocessors is provided in Annex III.
The optional independent dispute resolution mechanism is not selected.
Data subjects retain rights to pursue remedies under applicable law.
The SCCs are governed by the law of the Member State in which the Controller is established, provided that such law allows for third-party beneficiary rights.
If the Controller is not established in the EEA, the SCCs shall be governed by the law of Ireland.
Disputes arising under the SCCs shall be resolved in the courts of the EU Member State whose law governs the SCCs.
The description of transfers under the SCCs corresponds to the processing operations described in:
Annex I — Description of Processing
This includes:
The categories of:
are fully described in the DPA Annex I and are incorporated by reference.
Important operational realities include:
The security measures applicable to the SCCs are described in:
Annex II — Technical and Organisational Measures
This document describes:
No additional security claims beyond those described in Annex II apply.
The subprocessors authorised under the SCCs are listed in:
Annex III — Subprocessors
This annex identifies:
including their service function and processing location.
Where personal data processed under the Services is transferred outside the European Economic Area, SantaClues relies on:
EU-only processing is not enforced by system architecture, and certain subprocessors may process personal data outside the EEA.
Controllers should consider such transfers as part of their own compliance assessments.
Where personal data is transferred to a third country lacking an adequacy decision, SantaClues conducts Transfer Impact Assessments (TIAs).
TIAs evaluate:
Separate TIAs are maintained for relevant subprocessors.
In the event of conflict between the SCCs and other contractual documents: