Annex IV — Standard Contractual Clauses (SCCs)
Data Processing Agreement between [CUSTOMER] and [PLATFORM PROVIDER]Last Updated: [DATE]
Overview
This Annex IV forms part of the Data Processing Agreement ("DPA") between the Customer ("Data Controller") and [PLATFORM PROVIDER] ("Data Processor"). It addresses international transfer requirements under GDPR Chapter V.
1. Applicability
1.1 When SCCs Apply
SCCs are required when personal data is transferred from the EEA to a country without an adequacy decision under GDPR Article 45.
Current transfer scenarios:
| Transfer | From | To | Mechanism |
|---|---|---|---|
| [PLATFORM PROVIDER] → Google LLC (Firebase, Cloud Storage) | EU (EEA) | USA | EU-US Data Privacy Framework (DPF) + Google Cloud DPA SCCs |
| [PLATFORM PROVIDER] → Railway Corp. | EU (EEA) | USA | ⚠️ Not executed — Railway Data Processing Terms have been requested and not obtained; the transfer currently relies on EU-region deployment alone (see Section 3.1) |
| [PLATFORM PROVIDER] → NewsmanApp SRL | EU (EEA) | Romania (EEA) | No SCCs required — Romania is EU member state |
| Customer → [PLATFORM PROVIDER] | EEA | Romania (EEA) | No SCCs required — Romania is EU member state |
| [PLATFORM PROVIDER] → Anthropic PBC (Claude API) | EU (EEA) | USA | ⚠️ Not established — no executed agreement, Standard Contractual Clauses or adequacy-based mechanism is on file (see Section 3.1) |
| [PLATFORM PROVIDER] → Cloudflare, Inc. (reverse proxy, Turnstile, CDN) | EU (EEA) | Global edge network, USA | Cloudflare Customer DPA + Standard Contractual Clauses |
| [PLATFORM PROVIDER] → Meta Platforms, Inc. (Conversions API) | EU (EEA) | USA | Meta Data Processing Terms + Standard Contractual Clauses; transmitted on Customer's advertising account (see Section 3.2) |
| [PLATFORM PROVIDER] → TikTok Pte. Ltd. (Events API) | EU (EEA) | USA / Singapore | ⚠️ Not executed — Standard Contractual Clauses have been requested and not obtained (see Section 3.3) |
| [PLATFORM PROVIDER] → SendSMS.ro | EU (EEA) | Romania (EEA) | No SCCs required — Romania is EU member state |
| Attendee or visitor browser → Google LLC (Google Analytics, YouTube embed); staff browser → Google Fonts in the page-editor preview | EEA (visitor's device) | USA | Google's general terms for the service concerned; not covered by the Google Cloud DPA relied on above (see Section 3.1) |
| Attendee or visitor browser → Meta Platforms, Inc. and TikTok Pte. Ltd. (advertising pixels) | EEA (visitor's device) | USA / Singapore | Meta Business Tools Terms; TikTok Business Products Terms; transmitted on Customer's advertising accounts (see Section 3.2) |
| Attendee or visitor browser → Microsoft Corporation (Microsoft Clarity) | EEA (visitor's device) | EU (Microsoft Ireland Operations Limited), with onward transfer to USA | Microsoft Products and Services DPA + intra-group Standard Contractual Clauses; Microsoft acts as an independent controller |
Note: Romania is an EU member state. Transfers from Customer to [PLATFORM PROVIDER] do not require SCCs as both parties are within the EEA. [PLATFORM PROVIDER]'s persistent storage is located in the EEA — Railway EU region; Firebase Cloud Functions in europe-west3, Realtime Database in europe-west1, and Firestore in the EU multi-region. Attendee and visitor traffic to the production API is nevertheless routed through Cloudflare's global edge network before it reaches those EU origins, and the browser-side transfers listed above are made from the visitor's own device directly to the recipient, outside [PLATFORM PROVIDER]'s infrastructure.
Recipients engaged by [PLATFORM PROVIDER] and recipients engaged by Customer. Google LLC (Firebase and Cloud Storage), Railway Corp., NewsmanApp SRL, Cloudflare, Inc. and Anthropic PBC are engaged by [PLATFORM PROVIDER] and are addressed in the Transfer Impact Assessment at Section 3.1. The advertising platforms and the messaging providers are reached with credentials Customer supplies and are addressed at Section 3.2. Annex III lists Meta Platforms, Inc., Google LLC (Google Analytics and Google Ads), TikTok Pte. Ltd. and LinkedIn Corporation both as numbered [PLATFORM PROVIDER] sub-processors and as Customer-provided integrations; ⚠️ that classification determines which Party is the transfer exporter and is under review.
LinkedIn Corporation. No transfer to LinkedIn Corporation occurs. The LinkedIn Insight Tag and the LinkedIn Conversions API described in Annex III are provided for in the integration data model but are not implemented: no Insight Tag is emitted to a visitor's browser and no server-side conversion is sent.
GAP-CONTRACT-03 · CONTRACT — KNOWN GAP, REMEDIATION PENDING
This Annex previously recorded three recipients of personal data — Google LLC, Railway Corp. and NewsmanApp SRL — and no others. Personal data is in fact also transmitted to Anthropic PBC in the United States, to TikTok Pte. Ltd. in the United States and Singapore, to Cloudflare, Inc. across its global edge network, and, from the visitor's own browser, to Google LLC through YouTube video embeds; none of these recipients was recorded in this Annex or assessed in the Transfer Impact Assessment below. This divergence is recorded on the compliance remediation register and is under review.
2. Controller-to-Processor SCCs (Customer → [PLATFORM PROVIDER])
As both Customer and [PLATFORM PROVIDER] are established within the EEA, no SCCs are required for the primary Controller-to-Processor relationship. The DPA governs the processing relationship per GDPR Article 28.
2.1 UK Customers
For customers established in the United Kingdom, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to EU SCCs (ICO, in force March 2022) applies.
Contact [PLATFORM PROVIDER LEGAL EMAIL] to initiate execution of the appropriate UK transfer mechanism.
2.2 Other Non-EEA Customers
For customers established outside the EEA and the United Kingdom, personal data flows into the EEA: Customer, as controller, instructs [PLATFORM PROVIDER], as processor, to process personal data on infrastructure located within the EEA. A flow into the EEA is not a transfer within the meaning of GDPR Chapter V, and the EU Commission SCCs (2021, Decision 2021/914/EU) are not the instrument for it. The following applies instead:
- Governing terms: the DPA, which implements the requirements of GDPR Article 28(3), governs the processing relationship in full. No Chapter V transfer mechanism is required for personal data flowing from Customer into [PLATFORM PROVIDER]'s EEA infrastructure.
- Onward transfers by [PLATFORM PROVIDER]: transfers from [PLATFORM PROVIDER] to the recipients listed in Section 1.1 remain subject to the mechanisms recorded there, irrespective of Customer's place of establishment.
- Transfers back out of the EEA: where Customer instructs [PLATFORM PROVIDER] to return personal data to Customer's own systems, or to make it available to a third party outside the EEA — for example through contact and segment exports, advertising platform integrations, tracked-link destinations or outbound webhooks — that onward transfer is Customer's export and requires Customer's own transfer mechanism, as provided in DPA Section 6.3 (Customer Transfers).
- Governing law: Romania (GDPR member state). Jurisdiction: Romanian courts.
- Supervisory authority: the Romanian ANSPDCP is [PLATFORM PROVIDER]'s supervisory authority. A controller with no establishment in the Union has no lead supervisory authority under GDPR Article 56 and remains answerable to the supervisory authority of each Member State in which data subjects are affected.
⚠️ This Annex previously stated that the 2021 SCCs applied to non-EEA customers under Module 2 (Controller-to-Processor), with Customer as exporter and [PLATFORM PROVIDER] as importer, and that Annexes I(A), I(B), I(C) and II of that instrument would be completed accordingly. That describes a transfer out of the EEA and does not correspond to the direction in which personal data actually flows under this DPA. The corrected position stated above must be validated by qualified GDPR counsel before this Annex is executed.
To request the DPA and any transfer documentation applicable to your place of establishment, contact [PLATFORM PROVIDER LEGAL EMAIL]. [PLATFORM PROVIDER] will respond within 5 business days.
3. Transfer Impact Assessment (TIA)
3.1 USA Transfers (Recipients Engaged by [PLATFORM PROVIDER])
| Factor | Assessment |
|---|---|
| Legal framework | USA — CLOUD Act, FISA Section 702, Executive Order 14086 |
| Google adequacy mechanism | EU-US Data Privacy Framework (DPF, July 2023) — Google LLC is DPF-certified |
| Railway adequacy mechanism | ⚠️ None executed. Railway Corporation is established in the United States, so administrative access from the United States to data hosted in the EU region cannot be excluded. Railway's Data Processing Terms have been requested and not obtained, and no Standard Contractual Clauses are on file; the transfer relies on EU-region deployment alone. ⚠️ The deployment region is not evidenced in [PLATFORM PROVIDER]'s records and must be confirmed against the Railway project |
| Anthropic adequacy mechanism | ⚠️ Not established. AI generation requests are made server-side to api.anthropic.com, which is hosted in the United States, using a single platform-wide API key. No executed agreement, Standard Contractual Clauses or adequacy-based mechanism is on file, and Anthropic's retention period for API inputs and outputs has not been confirmed |
| Cloudflare adequacy mechanism | Cloudflare Customer DPA incorporating Standard Contractual Clauses. Cloudflare terminates TLS for attendee traffic in production and receives every attendee request, and Turnstile verification transmits the visitor's IP address to Cloudflare |
| Meta adequacy mechanism | Meta Data Processing Terms incorporating Standard Contractual Clauses. Server-side Conversions API events are transmitted on Customer's advertising account — see Section 3.2 |
| Supplementary measures | Persistent storage within the EEA: Cloud Functions in europe-west3, Realtime Database in europe-west1, Firestore in the EU multi-region. ⚠️ The Cloud Storage bucket location is not evidenced in [PLATFORM PROVIDER]'s records and must be confirmed. Encryption at rest and in transit; Google Cloud DPA with SCCs |
| Browser-side transfers to Google LLC | Not covered by the Google Cloud DPA cited above. The attendee watch page embeds video in a www.youtube.com iframe rather than the no-cookie variant. The request is made from the visitor's browser, before and irrespective of any cookie-consent decision, and discloses the visitor's IP address and user agent to Google LLC. Web fonts on published landing pages are served from the page's own domain and do not contact Google from the visitor's browser. See the Cookie Policy |
| Residual risk | Low for the Google Cloud transfer (DPF certification, EEA storage and SCCs in the Google Cloud DPA). ⚠️ Not assessed for Railway Corp. and Anthropic PBC, for which no transfer instrument has been executed, and for the browser-side transfers to Google LLC, which fall outside the instrument relied on for Firebase and Cloud Storage |
Conclusion: Transfers to Google LLC under the Google Cloud Data Processing and Security Terms are adequately protected, as are transfers to Cloudflare, Inc. under the Cloudflare Customer DPA. Transfers to Railway Corp. and to Anthropic PBC currently proceed without an executed transfer instrument, and the browser-side transfers to Google LLC identified above are outside the mechanism relied on for Firebase and Cloud Storage. No decision to suspend those transfers has been taken and none of them is presently suspended; the position is under review. This conclusion does not extend to the destinations assessed in Section 3.3.
Relationship with DPA Section 6.2. This Annex treats the Railway relationship as a transfer to a third country, on the basis that Railway Corporation is established in the United States and administrative access from the United States to data hosted in the EU region cannot be excluded. Section 6.2 of the DPA records the same relationship as "EU region hosting (no transfer)". This divergence is recorded on the compliance remediation register; the classification is under review.
3.2 Customer-Provided Integrations
Where Customer configures an integration with its own credentials, Customer is the transfer exporter and owns both the transfer mechanism and the Transfer Impact Assessment for that transfer. Annex III identifies the following Customer-provided integrations:
- Mobile push notifications (FCM) through Customer's own Firebase project — Google LLC (USA)
- Email delivery through Customer's own account with NewsmanApp SRL (Romania, EEA)
- CDN caching and cache purge through Customer's own Cloudflare account — Cloudflare, Inc. (global edge network)
- Advertising platforms on Customer's own advertising accounts — Meta Platforms, Inc. (USA), Google LLC for Google Analytics and Google Ads (USA), TikTok Pte. Ltd. (USA and Singapore) and LinkedIn Corporation (USA)
- Transactional SMS delivery through Customer's own account with SendSMS.ro (Romania, EEA)
For each of these, Customer is responsible for:
- Conducting their own TIA for the Customer ↔ third-party transfer
- Ensuring an appropriate transfer mechanism is in place (for Customer's own Firebase project, the Google Cloud DPA auto-applies)
- Disclosing the transfer to attendees in their Privacy Policy
[PLATFORM PROVIDER]'s TIA above does not cover Customer-provided integrations.
Transmission from EEA infrastructure. [PLATFORM PROVIDER] executes these transmissions on Customer's instruction and with Customer's credentials, but does so from infrastructure it operates within the EEA. Where the destination is outside the EEA — Meta Platforms, Inc., Google LLC, TikTok Pte. Ltd. — the allocation of exporter responsibility between the Parties should be read together with DPA Section 6.3 (Customer Transfers). ⚠️ Annex III classifies these recipients both as numbered [PLATFORM PROVIDER] sub-processors and as Customer-provided integrations; that classification is under review.
Customer-provided Firebase (FCM). When Customer uses their own Firebase project for push notifications (see DPA Section 3.4 and Annex III), Customer conducts their own TIA for the Customer ↔ Google (FCM) transfer, the Google Cloud DPA auto-applies on Customer's own Google Cloud account, and Customer discloses the transfer to attendees in their Privacy Policy. [PLATFORM PROVIDER]'s TIA above does not cover Customer-provided Firebase projects.
Messaging provider. SendSMS.ro is established in Romania (EEA), so message submission does not engage GDPR Chapter V.
Anthropic PBC is not a Customer-provided integration. AI generation is reached through a single platform-wide API key held by [PLATFORM PROVIDER]. There are no per-organisation credentials and no per-organisation switch, so Anthropic PBC is a [PLATFORM PROVIDER] sub-processor and is assessed in Section 3.1.
3.3 Transfers to Singapore and the USA (TikTok Pte. Ltd.)
The TikTok Events API server-side integration has been active since 8 May 2026. It sends a CompleteRegistration event to business-api.tiktok.com on every registration for any organisation that has enabled the TikTok integration. It transmits SHA-256 hashes of the registrant's email address, first name, last name and registration identifier, together with the registrant's raw IP address, raw user agent, the ttclid click identifier and the _ttp cookie value. No telephone number is transmitted on this path: the field is left empty when the event is assembled, whatever number is held on the contact. There is no advertising-consent gate; the only suppression is a GDPR Article 18 processing restriction.
| Factor | Assessment |
|---|---|
| Destinations | USA and Singapore (TikTok data centers, per Annex III) |
| Legal framework | USA — CLOUD Act, FISA Section 702, Executive Order 14086. Singapore — no adequacy decision under GDPR Article 45 |
| Adequacy mechanism | None. TikTok Pte. Ltd. is not certified under the EU-US Data Privacy Framework, and no adequacy decision covers Singapore |
| Transfer mechanism | ⚠️ Not executed. Standard Contractual Clauses have been requested from TikTok and have not been obtained |
| Government-access risk | Requires assessment of Singapore law and of the possibility of access by TikTok group entities established outside the EEA. ⚠️ Not assessed |
| Supplementary measures | Directly identifying fields are SHA-256 hashed before transmission. The IP address and the user agent are transmitted unhashed, and the hashes are supplied to TikTok precisely so that they can be matched against TikTok's own user records, so hashing does not operate as an effective supplementary measure for this transfer |
| Residual risk | ⚠️ Not assessed |
Conclusion: No decision to suspend or to continue the TikTok transfer has been recorded. The conclusion at Section 3.1 is limited to the recipients assessed there and does not extend to TikTok Pte. Ltd.
GAP-CONTRACT-02 · CONTRACT — KNOWN GAP, REMEDIATION PENDING
This Annex previously assessed transfers to the United States only for Google LLC and Railway Corp., and concluded that no suspension of transfers was required. The TikTok Events API has in fact been transmitting hashed contact identifiers, together with the registrant's unhashed IP address and user agent, to TikTok Pte. Ltd. in the United States and Singapore on every registration since 8 May 2026, without executed Standard Contractual Clauses and without an advertising-consent gate. This divergence is recorded on the compliance remediation register and is under review.
4. Sub-Processor SCC Status
| Sub-Processor | Transfer Mechanism | SCC Module | Status |
|---|---|---|---|
| Google LLC (Firebase / Cloud) | EU-US DPF + Google Cloud DPA | Module 3 (P2P) | Active — Google auto-applies |
| Railway Corp. | ⚠️ None executed — EU-region deployment only | Module 3 (P2P), where executed | ⚠️ Not executed — Data Processing Terms requested from Railway and not obtained |
| NewsmanApp SRL | No SCCs required (EEA) | N/A | Romania (EU) |
| Anthropic PBC | ⚠️ Not established | Module 3 (P2P), where executed | ⚠️ Not executed — no agreement, SCCs or adequacy-based mechanism on file |
| Cloudflare, Inc. | Cloudflare Customer DPA + SCCs | Module 3 (P2P) | Active — Cloudflare standard terms |
| Meta Platforms, Inc. | Meta Data Processing Terms + SCCs, on Customer's advertising account | Module 3 (P2P) | Active — Meta standard terms; ⚠️ exporter classification under review (Section 3.2) |
| Google LLC (Google Analytics / Google Ads) | EU-US DPF + Google Ads Data Processing Terms, on Customer's advertising account | Module 3 (P2P) | Active — Google auto-applies; ⚠️ exporter classification under review (Section 3.2) |
| TikTok Pte. Ltd. | ⚠️ Not established | Module 3 (P2P), where executed | ⚠️ Not executed — SCCs requested from TikTok and not obtained; the server-side Events API is live (Section 3.3) |
| LinkedIn Corporation (Microsoft) | Microsoft Products and Services DPA + SCCs | Module 3 (P2P) | Not implemented — no transfer occurs |
| Microsoft Corporation (Microsoft Clarity), contracted for EU customers via Microsoft Ireland Operations Limited | Microsoft Products and Services DPA + intra-group SCCs | N/A — Microsoft acts as an independent controller | Active — Microsoft standard terms |
| SendSMS.ro | No SCCs required (EEA) | N/A | Romania (EU) |
Copies of the transfer instruments identified above as active, whether executed or auto-applied, are available upon written request to [PLATFORM PROVIDER LEGAL EMAIL]. No copy can be produced for an instrument marked as not executed or not established, because no such instrument exists.
GAP-CONTRACT-01 · CONTRACT — KNOWN GAP, REMEDIATION PENDING
This Annex previously recorded the Railway transfer mechanism as "SCCs (Module 3) + EU region" with the status "Active — Railway DPA", and offered copies of executed or auto-applied Standard Contractual Clauses on request without qualification. No Railway Data Processing Agreement and no Standard Contractual Clauses have been obtained — Annex III records the safeguard as requested and not yet obtained — so the transfer relies on EU-region deployment alone and no instrument exists that could be produced on request. This divergence is recorded on the compliance remediation register and is under review.
5. Updates to This Annex
[PLATFORM PROVIDER] will update this Annex when:
- A new sub-processor requires international transfer safeguards
- The European Commission updates or replaces SCC templates
- The EU-US Data Privacy Framework is invalidated or materially changed
- New adequacy decisions are adopted or revoked
Customers will be notified per DPA Section 5.3 (Changes to Sub-Processors) and DPA Section 15.2 (Changes to Annexes), which provide for 30 days' notice of sub-processor additions.
Transfers introduced since this Annex was prepared. The following transfer-relevant changes took effect after this Annex was prepared and are reflected in the tables above for the first time:
- 22 February 2026 — AI generation through Anthropic PBC (USA)
- 21 April 2026 — server-side Meta Conversions API PageView on funnel landing pages
- 8 May 2026 — TikTok Events API server-side mirror (USA and Singapore)
- 10 June 2026 — Cloudflare, Inc. placed in path as a reverse proxy in front of attendee traffic in production
This Annex records no advance notification of these additions under DPA Section 5.3.
GAP-CONTRACT-04 · CONTRACT — KNOWN GAP, REMEDIATION PENDING
This Annex undertakes to be updated whenever a new sub-processor requires international transfer safeguards, and DPA Section 6.2 commits [PLATFORM PROVIDER] to reviewing the Transfer Impact Assessment annually. Four transfer-relevant changes took effect between February and June 2026 without this Annex being revised, and no completed annual review of the Transfer Impact Assessment is recorded. This divergence is recorded on the compliance remediation register and is under review.
6. Contact for SCC Execution
Email: [PLATFORM PROVIDER LEGAL EMAIL] Subject: "SCC Execution Request — [Customer Name]"
Response within 5 business days.
Document Version: 1.0 (DRAFT) Prepared by: [Legal Team] Review Status: ⚠️ REQUIRES LEGAL REVIEW — TIA conclusions and SCC module selections must be validated by qualified GDPR counsel before use.
Last Updated: [DATE]