International Data Transfer Annex

The Standard Contractual Clauses adopted by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (“EU SCCs”) are incorporated by reference. Module Two applies when Customer is Controller; Module Three applies when Customer acts as Processor for an underlying Controller. Applicable onward transfers use the appropriate module and safeguards.

• Clause 7: The docking clause applies.
• Clause 9: Option 2, general written authorization, applies. Notice and objection procedures are those in the DPA's Subprocessors section, with at least 15 days' advance notice.
• Clause 11: The optional independent dispute-resolution provision does not apply.
• Clause 17: Irish law governs the EU SCCs.
• Clause 18: The courts of Ireland have jurisdiction under the EU SCCs.

• Annex I.A, exporter: Customer identified in the Agreement, with its account and notice contacts; role is Controller or Processor as applicable.
• Annex I.A, importer: Ad Spend Technologies, Inc., 1460 Broadway, New York, NY 10036, USA; support@theadspend.com; role is Processor or Subprocessor. Relevant activity is provision of the Service under the DPA.
• Acceptance: The parties' acceptance of the Agreement and DPA constitutes acceptance of these incorporated transfer terms.
• Annex I.B: The categories of data subjects, personal data, purposes, nature, frequency, and duration are specified in DPA Annex 1. Special-category data is not requested or permitted except by express agreement addressing the necessary safeguards.
• Annex I.C: The competent supervisory authority is determined under Clause 13, based on the exporter's establishment, representative, or relevant data subjects as applicable.
• Annex II: Technical and organizational measures are specified in DPA Annex 2. Assistance measures include the request-handling, incident-response, and cooperation procedures in the DPA.
• Annex III: The applicable current subprocessor register supplies identities, locations, purposes, and processing limitations.

For transfers subject to the UK GDPR, the ICO's International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0 in force 21 March 2022 (“UK Addendum”), is incorporated.

Table 1 uses the parties and contact details above and in the Agreement. Table 2 uses the EU SCCs, modules, and selections specified above. Table 3 uses DPA Annexes 1 and 2 and the subprocessor register. For Table 4, both importer and exporter may end the UK Addendum as its mandatory clauses permit. The UK Addendum controls its interpretation and applicable law and forum, including England and Wales as required by its terms.

For transfers subject to the Swiss FADP, the EU SCCs apply with necessary adjustments: references to the GDPR include the FADP as applicable; the FDPIC is the competent authority for transfers governed exclusively by the FADP; and references to a member state are interpreted to include Switzerland to preserve applicable data-subject rights and access to the competent Swiss forum.

We maintain appropriate safeguards, including those in DPA Annex 2, taking into account the nature and risks of the transfer. For legally binding public-authority requests, we notify Customer where legally permitted, assess and challenge unlawful or overbroad requests as required, and disclose only the information legally required.

The applicable mandatory transfer clauses prevail over conflicting provisions of the DPA, Terms, MSA, or Order for the relevant transfer. Commercial liability, arbitration, or choice-of-law provisions do not override non-waivable rights under those clauses. The official operative SCC and UK Addendum texts are incorporated, not rewritten by this summary.

Questions may be sent to support@theadspend.com.