DPA Annex D — International Transfers

This is an activation and completion schedule, not a self-executing substitute for mandatory statutory clauses. Counsel must check applicable laws, actual export/import flows, organization roles and vendor regions. If no restricted transfer is involved for a module, mark it Not Applicable with reasoning instead of incorporating boilerplate.

1. Verified transfer map (mandatory before signature)

2. Canada and Québec (conditional)

2.1 Where PIPEDA applies, the Parties will implement appropriate contractual/organizational protection and transparency for overseas processing; Customer's accountability and SiteAxis's processor obligations will be mapped by actual role and law. This does not create a blanket requirement for Canadian-only hosting.

2.2 Where Québec private-sector requirements apply, Customer and SiteAxis will determine who must perform an evaluation of privacy-related factors prior to a covered communication of personal information outside Québec, the required written agreement, applicable notice/consent and appropriate safeguards. Applicability/PIA/transfer sign-off: To be confirmed: quebec transfer assessment. Do not promise Québec-exclusive processing without an executed region commitment.

3. EU GDPR — restricted transfers (conditional)

Activation: To be confirmed: eu transfer applicability. For a transfer requiring the European Commission's international-transfer SCCs (Commission Implementing Decision (EU) 2021/914), the Parties must execute or validly incorporate their complete operative text, select appropriate Module To be confirmed: eu scc module selection, name exporter/importer(s), describe transfers, select options and complete Annexes I, II and III with correct authorities and security measures. The GDPR Article 28 controller–processor clauses and international transfer SCCs are different instruments and neither should be confused with the other.

SCC document/version reference: To be confirmed: eu scc executed instrument Parties/roles and authority: To be confirmed: eu scc party details Annexes/security and subprocessors: To be confirmed: eu scc annex reference Transfer impact/supplementary measures: To be confirmed: eu transfer risk assessment.

Official text: https://commission.europa.eu/publications/publications-standard-contractual-clauses-sccs_en . Do not rewrite mandatory SCCs based on the General Legal summary.

4. United Kingdom (conditional)

Activation: To be confirmed: uk transfer applicability. Counsel selects an effective UK International Data Transfer Agreement (IDTA) or legally valid UK Addendum to EU SCCs and completes all required tables and appended instruments: To be confirmed: uk transfer executed instrument. Verify applicable ICO guidance and law at signature; do not assume EU SCCs alone cover a UK restricted transfer. Official guidance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/ .

5. Switzerland (conditional)

Activation: To be confirmed: swiss transfer applicability. Counsel validates whether Swiss law requires adapted standard clauses or another valid mechanism, documents the chosen supervisory authority, Swiss terminology/rights, lawful recipient and transfer map: To be confirmed: swiss transfer executed instrument.

6. United States state privacy laws (conditional)

Activation: To be confirmed: us state privacy applicability. Where California or other U.S. state laws apply to particular data and roles, execute 23_US_STATE_PRIVACY_ADDENDUM.md with law-specific restrictions, assistance, notice, assessment, subcontracting, lawful retention and audit provisions. Do not apply California-specific sale/share terms to every B2B processing activity without analysis. Document To be confirmed: us state applicability analysis.

7. Supplemental measures and monitoring

Each Party will reasonably support needed assessments, government access request handling subject to law, technical protections, documented subprocessors and updates to mechanisms where invalidated. Any specific law-enforcement request notice or data-residency undertaking must reflect legal constraints and verified service capabilities.

Signed annex status: To be confirmed: transfer schedule execution status · Counsel: To be confirmed: counsel approval reference.