Snapshot 223630
Normalized text
Scripts and page chrome removed; this is what change detection compares.
← Back to Home Data Processing Addendum Version 2.1 · Last updated September 18, 2026 This Data Processing Addendum (DPA) forms part of the agreement governing Customer's use of Salted's services (Agreement). It is between Salted a.s., with its registered office at Antala Staška 1859/34, Krč, 140 00 Praha 4, Czech Republic, company identification number 17327008, registered with the Municipal Court in Prague under file B 27458 (Provider or Salted), and the customer identified in the Agreement (Customer). Each is a Party and together they are the Parties. This DPA governs Personal Data processed by Provider on Customer's behalf. It includes the four Schedules below. The Agreement determines the Services purchased and their commercial terms; this DPA determines the applicable processing obligations. 1 Definitions 1.1 Agreement means the applicable agreement, including its Order Forms, incorporated service schedules and expressly accepted amendments. Capitalized terms not defined in this DPA have the meanings given in the Agreement or applicable Data Protection Laws. 1.2 Controller means a person or entity that determines the purposes and means of Processing Personal Data, or the equivalent role under applicable Data Protection Laws. 1.3 Customer Instructions means the documented instructions described in Section 3.1. 1.4 Customer Personal Data means Personal Data within Customer Data processed by Provider on Customer's behalf. It includes Personal Data in communications, recordings, transcripts, attachments, integration records, knowledge content and Customer-specific outputs. Information does not cease to be Customer Personal Data merely because it appears in a diagnostic record or an exported copy. 1.5 Data Protection Laws means the laws applicable to the Processing of Customer Personal Data under the Agreement, including, where applicable, Regulation (EU) 2016/679 (EU GDPR or GDPR), applicable EU/EEA national data-protection laws, the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Swiss Federal Act on Data Protection (FADP), and applicable US state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act and its binding regulations (CCPA). References include amendments and replacements that apply to the relevant Processing. 1.6 Data Subject means an identified or identifiable person to whom Customer Personal Data relates, including a consumer where applicable under US privacy law. 1.7 EEA means the European Economic Area. 1.8 Personal Data means personal data, personal information or an equivalent category protected by applicable Data Protection Laws. 1.9 Processing means any operation performed on Personal Data, including collection, recording, organization, storage, access, analysis, transmission, disclosure, restriction, return and deletion. Related expressions have corresponding meanings. 1.10 Processor means a person or entity that Processes Personal Data on behalf of a Controller, or the equivalent role under applicable Data Protection Laws. 1.11 Restricted Transfer means a transfer of Customer Personal Data for which applicable EU, UK or Swiss law requires an international-transfer safeguard because the recipient or relevant Processing is outside the applicable protected territory and the transfer is not covered by an applicable adequacy decision or regulation. Remote access may constitute a transfer where the conditions under the applicable law are met. The existence and direction of a transfer depend on the actual data flow and recipient, not solely on a Party's contractual label. 1.12 Services means the Subscription Services and Professional Services purchased under the Agreement. 1.13 Security Incident means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data processed by Provider. 1.14 Subprocessor means a third party, including a Provider Affiliate, engaged by Provider to Process Customer Personal Data on Customer's behalf. 1.15 Subprocessor List means the list of Provider's Subprocessors, their functions and relevant Processing locations at www.salted.cx/subprocessors. 2 Scope, duration and priority 2.1 Roles Provider acts as a Processor. Customer acts as a Controller or, where it Processes information for another Controller, as a Processor. In the latter case, Customer must have authority to appoint Provider and issue the relevant instructions. Provider's obligations under this DPA continue to apply to its role as a Subprocessor. 2.2 Scope This DPA applies to Customer Personal Data processed under the Agreement to the extent that Processing is subject to Data Protection Laws. Salted's separate activities as a Controller are described in its Privacy Policy. The Privacy Policy does not authorize unrelated reuse of Customer Personal Data or change Provider's role for Customer-directed Processing. 2.3 Duration This DPA applies while Provider or its Subprocessors Process Customer Personal Data under the Agreement, including during any authorized transition, retrieval, deletion or legally required retention period. Termination of commercial access does not end the applicable data-protection obligations. 2.4 Priority and amendments Mandatory law and the mandatory priority of applicable Standard Contractual Clauses or other agreed transfer mechanisms prevail. Subject to those requirements, a mutually signed amendment that expressly identifies and changes a provision of this DPA governs that provision. This DPA otherwise takes precedence over the Agreement on the Processing of Customer Personal Data. An expressly agreed data-residency restriction in an Order Form or other mutually signed agreement narrows the permitted locations for the data and Services it covers. It forms part of Customer Instructions and is not displaced by the general permission for worldwide Processing in this DPA. Commercial limitations of liability apply only to the extent permitted by Data Protection Laws and Schedule 3. They do not limit a Data Subject's rights or a supervisory authority's powers. Updating a website document alone does not amend an existing contractual DPA. The Parties will expressly agree amendments except where an applicable change process or mandatory law provides otherwise. 3 Processing instructions and permitted purposes 3.1 Customer Instructions Provider will Process Customer Personal Data only on Customer's documented instructions, including instructions concerning transfers, or as required by applicable law. Where legally permitted, Provider will inform Customer of a legal requirement before Processing outside those instructions. Customer Instructions consist of the Agreement, this DPA, the agreed scope and configuration, instructions issued through authorized use of the Services, and other reasonable documented instructions consistent with the Agreement. Schedule 1 describes the subject matter, purposes, nature, data categories and duration of Processing. Material changes to scope or fees require the agreement specified in the Agreement; this does not limit statutory rights. Provider will promptly inform Customer if, in its opinion, an instruction infringes Data Protection Laws and will not carry out an instruction it knows to be unlawful. The Parties will cooperate to resolve the issue. Provider does not assume responsibility for continuously monitoring Customer's overall legal compliance. 3.2 Confidentiality Provider will protect Customer Personal Data under this DPA and the Agreement. Personnel authorized to Process it must be subject to appropriate written or statutory confidentiality obligations. Access must be limited to what is required for their authorized responsibilities. These protections continue for retained Customer Personal Data after the commercial term ends. 3.3 Responsibilities of the Parties Each Party will comply with Data Protection Laws applicable to its role. Customer is responsible for the lawfulness of its purposes, instructions and collection of Customer Personal Data, including required notices, lawful bases and any additional conditions for sensitive data. Provider remains responsible for its own Processing, security, assistance and Subprocessor obligations; Customer's responsibilities do not replace those duties. 3.4 Changes in law The Parties will cooperate in good faith on amendments and measures reasonably necessary to address applicable changes in Data Protection Laws. Neither Party must follow an instruction or continue a transfer that is unlawful. 3.5 AI and Customer-specific Processing Provider will not use health data or other special categories of Customer Personal Data to train or improve general-purpose AI models or models shared across customers, and will ensure that its Subprocessors do not do so. This restriction does not prevent Customer-specific configuration, knowledge retrieval or evaluation performed solely on Customer's behalf within the agreed Services. Other Customer Personal Data remains subject to Customer Instructions and the agreed purposes. Describing information as telemetry, aggregated information or a model output does not remove the protections of this DPA where the information remains Personal Data. 4 Subprocessors 4.1 Authorization and responsibility Customer generally authorizes Provider to use Subprocessors, including its Affiliates, subject to this Section, agreed residency restrictions and Schedule 3. This general authorization does not require a separate signature or affirmative approval for each change completed under Sections 4.3 and 4.4. Provider will enter into a written agreement imposing the data-protection obligations required by applicable law, including obligations providing at least the protection required for the relevant Processing under this DPA. Provider remains responsible for the performance of its Subprocessors' obligations as required by applicable law. 4.2 Published list Provider will maintain an up-to-date Subprocessor List identifying the providers, functions and relevant Processing locations. A provider's appearance on the list does not mean that it Processes every Customer's data. The providers used for a Customer depend on the purchased Services, configuration and any express restrictions. Provider will make available information reasonably necessary for Customer to assess the relevant Subprocessor's data-protection safeguards. 4.3 Notice of changes Provider will give each affected Customer at least 15 calendar days' prior written notice before an intended addition or replacement of a Subprocessor, or a material change to its Processing or locations affecting Customer Personal Data. A longer notice period applies where expressly agreed or where required to provide a meaningful opportunity to assess the change under applicable Data Protection Laws, taking account of the nature and complexity of the Processing. Notice will identify the provider, relevant function, data categories, Processing locations and proposed effective date, and provide or link to information reasonably necessary to assess the relevant safeguards. Provider will send the notice by email to Customer's designated data-protection contact or, if none is designated, its account contact, and will also update the Subprocessor List. Receiving these contractual notices does not require a subscription to a mailing list. Customer must keep its contact details current. Provider will retain a record of the notice and its delivery. An existing expressly agreed location restriction continues to apply. A notice of change is not permission to override that restriction. Customer may contact privacy@salted.cx to update its notification contact or request further information. 4.4 Objections Customer may object in writing within the applicable advance-notice period on reasonable data-protection grounds, explaining those grounds in sufficient detail to allow Provider to assess and address them. If Customer does not object within that period, the change is authorized under the general authorization without further approval, subject to all other requirements of this DPA. Following receipt of a timely, reasonable objection, the Parties will discuss it in good faith and seek an appropriate alternative, such as a different configuration or provider, for up to 15 calendar days, unless they agree in writing to extend that discussion period. Provider will not begin the objected-to Processing of that Customer's Personal Data while the objection remains unresolved. The objection does not prevent Provider from engaging or using the Subprocessor for other customers or for activities that do not involve the objecting Customer's Personal Data. If the objection remains unresolved at the end of the discussion period and Provider cannot reasonably provide the affected Services without the change, either Party may terminate only those affected Services on written notice. Provider will refund prepaid fees for the unused period of the terminated Services. Customer will not owe an early-termination penalty or fees for the remaining commitment period for those Services, without affecting charges accrued before termination. Termination and any required transition must be arranged without entrusting that Customer's Personal Data to the disputed Subprocessor. Expiry of the discussion period does not itself authorize the objected-to Processing. Obligations concerning return and deletion continue to apply. This process does not limit remedies for a breach of the Agreement or this DPA, rights under applicable Data Protection Laws or mandatory transfer clauses, or a supervisory authority's powers. 4.5 Backup providers and urgent changes Provider may identify named backup or alternative Subprocessors and their intended functions and locations in advance, and obtain authorization when the DPA is accepted or through the notice and objection process above. Provider may activate an already-authorized Subprocessor within its disclosed and authorized scope without repeating that process, provided there is no addition, replacement or material change requiring notice under Section 4.3. Required safeguards, Subprocessor agreements and transfer documentation must be in place before Processing begins. Where an urgent replacement is needed to protect security or service continuity, Provider may seek Customer's expedited written authorization for the specific replacement, subject to applicable Data Protection Laws and Schedule 3. Urgency alone does not dispense with applicable notice or authorization requirements, permit Processing contrary to Customer Instructions, or override agreed residency restrictions or required safeguards. 5 Security and incident response 5.1 Security measures Provider will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against Security Incidents. The measures must take account of the state of the art, implementation costs, nature, scope, context and purposes of Processing, and risks to individuals. Schedule 2 describes the required controls. Provider will regularly assess their effectiveness and will not materially reduce the agreed level of protection during the Agreement. 5.2 Incident notification Provider will notify Customer without undue delay and in any event within 48 hours after becoming aware of a Security Incident affecting Customer Personal Data. Provider will not delay the initial notice because the investigation is incomplete. To the extent known, the notice will describe the nature of the incident, affected categories and approximate numbers of Data Subjects and records, likely consequences, measures taken or proposed, and a contact for further information. Provider may provide information in phases without undue further delay. It will investigate, take reasonable measures to contain and remediate the incident, preserve relevant evidence and assist Customer with its applicable notification and response obligations. Notice does not by itself constitute an admission of liability. Unsuccessful attempts that do not compromise Customer Personal Data are not Security Incidents. An event affecting the availability or integrity of Customer Personal Data is not excluded merely because no disclosure occurred. 5.3 Customer responsibilities Customer is responsible for security within the systems and access arrangements it controls, including its users, credentials and Customer-procured systems. Customer must assess whether the agreed Services are appropriate for its Processing. These responsibilities do not diminish Provider's own duties under this DPA or applicable law. Customer determines and makes notifications to authorities and individuals for which it is legally responsible. Provider will provide the assistance required under this DPA and comply with any notification obligations directly applicable to Provider. 6 Impact assessments and regulatory assistance Taking account of the nature of Processing and information available to Provider, Provider will assist Customer with its obligations concerning security, data-protection impact assessments and prior consultation with supervisory authorities. Provider will provide information reasonably needed to assess the relevant Processing and safeguards. Customer remains responsible for assessments and decisions that applicable law assigns to it. 7 Requests from individuals 7.1 Assistance Provider will assist Customer through appropriate technical and organizational measures, insofar as possible, in responding to requests to exercise rights under Data Protection Laws. Customer should use available self-service functions where reasonably sufficient; Provider will provide additional assistance where needed to fulfil the applicable obligation. 7.2 Requests received directly If Provider receives a request relating to Customer Personal Data, it will promptly notify Customer and, where appropriate, direct the individual to Customer. Provider will not respond substantively on Customer's behalf without instructions, except where required by law. The Parties will cooperate so that routing a request does not prevent compliance with a legal deadline. 8 Return and deletion 8.1 During the Services Customer may access, retrieve or delete Customer Personal Data through available functions and may request assistance or deletion in writing. Provider will act on valid deletion instructions without undue delay, subject to applicable law and the agreed scope. An exit deadline does not authorize ignoring an earlier valid instruction or statutory deadline. Retention during active use is determined by Customer Instructions and the agreed configuration, not by a general permission for indefinite storage. 8.2 After termination At Customer's choice, Provider will return or delete Customer Personal Data. Unless Customer requests earlier deletion, Provider will make the data remaining under its control available for retrieval for 30 calendar days after termination or expiry of the relevant Services. For a switching process governed by mandatory law and the Agreement, the termination date is determined by that process. A longer retrieval period may be expressly agreed or required by law. These obligations do not require recovery of data already deleted under Customer Instructions or an agreed retention policy. After return or expiry of the retrieval period, Provider will delete remaining copies without undue delay. Active-system deletion will be completed within 30 calendar days after the retrieval period or an earlier valid deletion instruction, unless a shorter period is legally required. All remaining Customer Personal Data, including backup copies, will be deleted or rendered irrecoverable no later than 90 calendar days after termination or expiry of the relevant Services. This deadline runs from termination or expiry, not from the end of the retrieval period. Provider will ensure that relevant Subprocessors comply with these deadlines. Pending deletion, backup copies will be isolated from ordinary use. If a backup is restored, the deletion instruction must be reapplied before ordinary Processing resumes. Deletion will follow industry-standard secure deletion practices. Provider will issue a certificate of deletion on Customer's written request. 8.3 Legally required retention The only exception to deletion is where applicable law requires storage. For Personal Data governed by the EU GDPR, the exception is limited to storage required by Union or Member State law as provided in Article 28(3)(g). Any legally retained information remains subject to this DPA's confidentiality, security and purpose restrictions for the legally required period. Standard backup or record-retention policies do not extend the deadlines. Any stricter applicable legal requirement prevails. 9 Demonstrating compliance and audits 9.1 Records and information Provider will keep records required by Data Protection Laws and make available the information necessary to demonstrate compliance with this DPA. On request, Provider will describe its relevant audit and certification programs, if any, and make available relevant existing reports or summaries subject to appropriate confidentiality protections. This DPA does not represent that Provider holds a particular certification. 9.2 Customer audits Provider will allow and contribute to audits, including inspections, by Customer or an independent auditor mandated by Customer where needed to verify compliance or required by law. Existing reports may be used where sufficient, but do not eliminate a right to further examination when necessary. The Parties will agree reasonable arrangements concerning scope, timing, confidentiality and protection of other customers' information. Routine audits will normally occur during business hours on reasonable advance notice and no more than annually. These arrangements do not restrict additional or urgent audits required by law, a competent authority or a Security Incident, and agreement on an audit plan must not be unreasonably withheld or delayed. Provider will provide information concerning relevant Subprocessors and exercise applicable rights with them as needed; Customer receives no unrestricted physical-access right to a third party's premises merely through this DPA. 9.3 Costs and disclosures Customer bears its own ordinary audit costs. Reasonable Provider assistance costs may be agreed in advance, except for audits connected with a Security Incident or specifically requested by a competent authority. Costs or scheduling conditions must not frustrate mandatory audit rights. Customer may disclose findings to competent authorities or as otherwise required by law; other disclosures remain subject to confidentiality obligations. 10 Processing locations and international transfers 10.1 Worldwide delivery by default Unless an Order Form or other mutually signed agreement expressly restricts locations, Provider may Process Customer Personal Data worldwide, including in the EU/EEA and the United States, through its Affiliates and authorized Subprocessors as necessary to provide the agreed Services. This permission remains subject to this DPA, Customer Instructions and required international-transfer safeguards. It is not blanket permission for every provider to Process all Customer Personal Data in every country. 10.2 Agreed residency restrictions An expressly agreed EU data residency or other location restriction governs the data and Services it covers. The Parties will identify the applicable territory, data, Services and any permitted exceptions, including the treatment of storage, backups, support access and Customer-procured integrations. Provider will configure and use the covered Services and Subprocessors consistently with that commitment. Customer's address, currency or users' location does not itself establish a residency restriction. 10.3 Transfer safeguards Before making a Restricted Transfer, the responsible Party will ensure that a valid transfer mechanism applies and complete any required assessment and supplementary measures. Schedule 3 applies where the Parties rely on Standard Contractual Clauses. Provider is responsible for putting appropriate safeguards in place with its Subprocessors. A Customer-Provider DPA alone does not bind a Subprocessor that has not entered into the required agreement. 10.4 Regional requirements The applicable provisions of Schedule 4 supplement this DPA. A regional provision applies only to Processing governed by the relevant law and does not reduce protections that apply under another law. 11 Liability and enforcement The liability provisions of the Agreement, including expressly agreed Order Form changes, apply to claims between the Parties arising under this DPA to the extent permitted by applicable law. Liability under the Agreement and this DPA is aggregated as provided in the Agreement; this DPA does not create an additional general liability cap. No contractual limitation restricts liability or rights that cannot lawfully be limited, including applicable Data Subject rights, supervisory-authority powers and the liability provisions of mandatory transfer clauses. Nothing in this Section reduces Provider's obligations for Subprocessors under applicable law. Schedule 1 — Details of Processing S1.1 Parties and contacts Provider: Salted a.s., Antala Staška 1859/34, Krč, 140 00 Praha 4, Czech Republic; company identification number 17327008. Data-protection contact: privacy@salted.cx. Provider acts as a Processor or Subprocessor providing the agreed Services. Customer: The entity identified in the Order Form or accepted registration. Its address and data-protection or account contact are those supplied under the Agreement. Customer acts as a Controller or Processor according to the relevant Processing. Exporter and importer status is determined separately for each Restricted Transfer under Schedule 3. Neither Party is automatically the exporter or importer for every data flow. Acceptance of this DPA identifies the Parties and, where applicable, constitutes execution of the incorporated transfer clauses as described in Schedule 3. S1.2 Subject matter, nature and purposes Processing supports the customer-communication software and related implementation, integration and support purchased under the Agreement. Depending on the enabled Services, operations include collecting, receiving, organizing, storing, accessing, routing and transmitting communications; recording and transcription; knowledge retrieval; Customer-specific AI responses and authorized actions; assistance to Customer's personnel; analysis and reporting for Customer; exchange with Customer-authorized systems; troubleshooting; and return or deletion. The purposes are to provide, secure, maintain and support the agreed Services on Customer's behalf and follow lawful Customer Instructions. This description does not authorize unrelated marketing, sale of Customer Personal Data or unrestricted shared-model training. S1.3 Data Subjects Customer's customers, prospective customers, business partners, employees, contractors and other persons communicating with Customer or represented in its authorized systems. Where relevant to the agreed Services, these include patients, prospective patients, representatives or carers, and minors where Customer's services serve them. S1.4 Data categories Identity and contact details; professional and organizational information; service, account and transaction context supplied for the agreed workflow; telephone and communication metadata; voice recordings; email, chat, SMS and other message content; attachments; transcripts and summaries; knowledge content; appointment and callback records; information exchanged with authorized systems; and Customer-specific outputs, activity records and relevant diagnostic information. The actual categories depend on Customer Instructions and enabled features. S1.5 Sensitive information and additional safeguards Customer Personal Data may include data concerning health where necessary for the agreed Services, including patient communications, appointment administration and receipt and routing of medication-related requests. It may appear in communications, recordings, transcripts, summaries, attachments and authorized system exchanges. Provider will Process this information only for the agreed purposes and on Customer Instructions. Customer must establish the applicable lawful basis and additional legal condition for special-category Processing. Before Processing health data, the Parties will document the permitted scope, access restrictions, retention periods, Subprocessors and locations. Provider will ensure that relevant Subprocessor agreements permit the Processing and provide the required protections. Sections 3.5 and 5 and Schedule 2 apply. Other special categories require express written agreement. Special-category information received outside the agreed scope remains protected by this DPA; receipt does not authorize additional use. The Parties will cooperate to restrict and address unintended receipt. Permission to Process health data does not constitute a representation of HIPAA compliance. Protected health information governed by HIPAA requires Provider's express agreement and an applicable business associate agreement before Processing. Payment-card data requiring PCI DSS controls may be processed only through a separately agreed, appropriately configured workflow. The Services do not independently authorize clinical diagnosis, prescribing or emergency triage. S1.6 Frequency, duration and Subprocessors Processing and any transfers may be ongoing throughout delivery of the agreed Services. Active retention follows Customer Instructions and the agreed configuration. Post-termination retrieval and deletion follow Section 8, including the final 90-day deadline, subject to legally required retention. Provider's Subprocessor List identifies the functions and locations of available Subprocessors. The relevant providers and their Processing must be consistent with the Customer's Services and express restrictions. Provider will provide additional details necessary to complete an applicable transfer annex before the transfer begins. Schedule 2 — Technical and organizational measures The measures below apply to the extent relevant to Provider's Processing and the systems it controls. They are supplemented by the documented scope and safeguards for sensitive information and by any expressly agreed security schedule. Provider must be able to describe how the measures are implemented for the relevant Services; references to appropriate measures do not substitute for that assessment. S2.1 Physical security Provider will use appropriate physical access controls to prevent unauthorized access to facilities and equipment used for Customer Personal Data. Where infrastructure is operated by a Subprocessor, Provider will assess and contract for appropriate safeguards applicable to that infrastructure. S2.2 Access and authorization Access will be limited to authorized personnel according to their responsibilities and the principle of least privilege. Provider will maintain processes for granting, reviewing and withdrawing access, appropriate authentication controls and protection of credentials. Authentication strength must be proportionate to the risk, including for privileged access and sensitive information. S2.3 System and application security Provider will maintain controls designed to prevent unauthorized reading, copying, alteration or removal of Customer Personal Data. Relevant controls include appropriate system configuration, change management, security updates, vulnerability management and security monitoring. Provider will review the effectiveness of controls and address identified risks. S2.4 Transmission and storage Provider will use appropriate safeguards, including encryption where appropriate to the risk, for Customer Personal Data in transit and at rest. The applicable protection must take account of sensitive content, access paths and integrations. Transfers will be limited to authorized recipients and purposes, with measures to protect integrity and confidentiality. S2.5 Logging and traceability Provider will maintain appropriate records of access and material actions affecting Customer Personal Data to support security monitoring, investigation and accountability. Relevant logs must themselves be protected, access-restricted and retained according to their purpose and the applicable instructions or legal requirements. S2.6 Backup, availability and deletion Provider will take regular, secured and encrypted backups where it hosts Customer Personal Data and maintain appropriate restoration and continuity arrangements. Backup and recovery processes must remain consistent with Customer Instructions and Section 8. A restored backup must not reintroduce previously deleted data into ordinary Processing. Backup policies do not extend the final deletion deadline. S2.7 Separation and minimization Provider will maintain logical separation of Customer data within shared systems and restrict access between customers. Data used for support, diagnostics or evaluation must be limited to what is reasonably necessary for the permitted purpose. Customer Personal Data must not become available to another customer through configuration, retrieval or output generation. S2.8 Personnel, incidents and ongoing review Provider will maintain appropriate confidentiality arrangements, security awareness, incident-response procedures and regular assessment of its measures. Customer will assess the suitability of the Services for its intended Processing and provide relevant requirements. Provider will assist with that assessment and remains responsible for its own obligations under Article 32 GDPR and other applicable law. No clause makes Customer solely responsible for Provider's security. Schedule 3 — International-transfer mechanisms S3.1 Applicability and definitions EU SCCs means the Standard Contractual Clauses in the Annex to Commission Implementing Decision (EU) 2021/914. UK Addendum means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, Version B1.0, including revisions applying under its mandatory clauses. This Schedule applies only where a Restricted Transfer occurs and the identified clauses are a legally available mechanism for that transfer. It does not require transfer clauses for a transfer covered by a valid adequacy decision. Where the EU SCCs are not an available mechanism for the actual transfer, the Parties must document another lawful mechanism before proceeding. Nothing in this DPA amends the mandatory content of incorporated transfer clauses. S3.2 Transfers between Customer and Provider Where the EU SCCs apply to a Restricted Transfer between the Parties, they are incorporated into the Agreement. The transferring Party is the exporter and the receiving Party is the importer for that transfer. The applicable module follows the actual roles: Module 2 applies to a transfer by a Controller to a Processor, including Customer-to-Provider transfers where those are the actual roles and the transfer qualifies. Module 3 applies to a transfer by a Processor to another Processor, including a Subprocessor, in the applicable transfer direction. Module 4 applies where Provider, acting as a Processor, transfers Customer Personal Data to Customer acting as a Controller, where that module is applicable to the actual transfer. Provider's separate Controller activities are not converted into Processor activities by this Schedule. Any transfer relating to such separate activities requires its own appropriate analysis and mechanism. For each applicable module, the Parties agree the following selections to the extent that the relevant clause is available in that module: Clause 7: the optional docking clause does not apply unless separately agreed. Clause 9: Option 2, general written authorization, applies. Prior notice is at least 15 calendar days, or the longer period applicable under Section 4.3, and follows Section 4. The actual importer is responsible for fulfilling its applicable Subprocessor obligations. Section 4 does not reduce any mandatory notice, authorization or other requirement of the applicable clauses. Clause 11: the optional independent dispute-resolution language does not apply. Clause 13 and Annex I.C: the competent authority is determined under Clause 13 for the actual exporter. It is the Czech Office for Personal Data Protection where Provider is the exporter and that authority is competent; otherwise the appropriate authority must be identified for the relevant exporter before the transfer begins. Clause 17: Czech law applies, using Option 1 where relevant, provided it permits the required third-party beneficiary rights. Mandatory UK and Swiss adaptations below apply to their respective transfers. Clause 18: the courts of the Czech Republic apply where that selection is permitted by the module, without restricting a Data Subject's mandatory rights. Schedules 1 and 2, together with the specific information incorporated in the Order Form or a documented transfer schedule, supply Annex I.A, Annex I.B and Annex II. The information must identify the actual parties, contacts, roles, transfer, purposes, data, frequency, retention and applicable security measures with sufficient specificity. Any missing information required by the clauses must be completed and agreed before the Restricted Transfer begins. If a competent authority or transfer role changes, the information must be updated consistently with the clauses. By expressly accepting this DPA and the completed applicable annex information, the Parties execute the incorporated clauses for that transfer. S3.3 Provider's onward transfers Provider will ensure that any Restricted Transfer to a Subprocessor is covered by an appropriate agreement and transfer mechanism with the actual recipient. Where appropriate, this includes Module 3 for Processor-to-Processor transfers, with Provider as exporter and the Subprocessor as importer. The required annex information and security measures must be completed for that relationship. A third party is not deemed to have signed transfer clauses merely because it appears on the Subprocessor List. Provider will comply with applicable requirements for transfer assessments, supplementary safeguards, onward transfers and government-access requests. Where the applicable clauses require it, Provider will notify Customer if it cannot comply, suspend the affected transfer and cooperate on lawful alternatives. Provider will provide information reasonably necessary for Customer to assess the relevant safeguards, subject to appropriate protection of confidential information. S3.4 Swiss transfers For a Restricted Transfer governed by the FADP, the EU SCCs apply with the adaptations required for recognition under Swiss law. References to Personal Data and Data Subjects cover the corresponding Swiss concepts. The Swiss Federal Data Protection and Information Commissioner is the competent authority for the Swiss-law aspects. References to EU Member States must not prevent individuals in Switzerland from enforcing their applicable rights in Switzerland. For a transfer governed exclusively by the FADP, references to GDPR are read as references to the FADP where appropriate, Swiss law governs and the competent Swiss courts apply. Where both GDPR and FADP apply, the GDPR selections remain effective for the GDPR aspects and the Swiss adaptations supplement them for the FADP aspects; they do not displace mandatory EU protections. The Parties will document any additional adaptations required for the actual transfer before it begins. S3.5 UK transfers For a Restricted Transfer governed by UK GDPR where the UK Addendum is the appropriate mechanism, the UK Addendum is incorporated with the applicable EU SCCs. Table 1 uses the actual exporter and importer details, contacts and acceptance identified in Schedule 1 and the completed transfer information. Table 2 identifies the EU SCCs and the modules and selections applicable under this Schedule. Table 3 comprises the completed annex information described above, including applicable Subprocessor information. In Table 4, both the exporter and importer may end the UK Addendum as permitted by its mandatory terms. Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses. Those mandatory clauses apply in full, including their priority, governing-law, jurisdiction and revision provisions. They prevail over inconsistent wording in this DPA for the relevant UK transfer. Any required table information must be completed before the transfer begins. If the UK Addendum is not appropriate, the Parties must agree another mechanism permitted by UK GDPR, such as the applicable UK International Data Transfer Agreement. Schedule 4 — Region-specific terms S4.1 California This Section applies where Customer Personal Data is governed by the CCPA. Business purpose, commercial purpose, personal information, sell, share, business and service provider have the meanings given by the CCPA. Customer acts as the business or as a service provider authorized to appoint Provider, as applicable. Provider acts as a service provider for the relevant Processing. Customer discloses Customer Personal Data to Provider only for the limited and specific business purposes in Schedule 1 and the agreed Services. Provider will comply with applicable CCPA obligations and provide the level of privacy protection required by that law. Provider will not sell or share Customer Personal Data received under the Agreement. Provider will not retain, use or disclose Customer Personal Data for purposes other than the specified business purposes, including unrelated commercial purposes, or outside the direct business relationship with Customer, except to the extent expressly permitted by the CCPA. Provider will not combine Customer Personal Data with information received from another person or collected through its own interactions except where a service provider is permitted to do so by the CCPA. Customer may take reasonable and appropriate steps to verify that Provider's use is consistent with Customer's obligations, including through Section 9, and to stop and remediate unauthorized use. Provider will promptly notify Customer if it determines that it can no longer meet its applicable CCPA obligations. Provider will assist with consumer requests under Section 7 and impose applicable restrictions on its Subprocessors. Provider certifies that it understands and will comply with the restrictions in this Section. S4.2 Other applicable US state privacy laws Where another US state privacy law applies to Provider's Processing of Customer Personal Data, Provider will act as Customer's Processor within the meaning of that law, follow lawful instructions, impose required confidentiality and Subprocessor protections, assist with applicable individual requests and risk assessments, provide required compliance information, and return or delete the information as required by that law and this DPA. Any mandatory regional requirement prevails over a less protective general provision. This Section does not constitute a representation that every US state privacy law applies to every Customer or Processing activity.