Transfers of Personal Data from the DIFC to a recipient outside the DIFC will be handled in accordance with DIFC Data Protection Law requirements, including adequacy or appropriate safeguards.

Where EU/EEA personal data is transferred to a non-adequate country, the parties may incorporate:

• the EU Standard Contractual Clauses (SCCs) (2021/914), module(s) appropriate to the transfer.

Where UK personal data is transferred to a non-adequate country, the parties may incorporate:

• the UK International Data Transfer Agreement (IDTA), or
• the EU SCCs plus the UK Addendum.

Where required, parties will conduct and document a transfer risk assessment and implement supplementary measures as appropriate.

If Customer purchases a data residency option, processing locations are defined in the Order Form.

• Schedule A: EU SCCs (attach executed SCCs)
• Schedule B: UK IDTA or UK Addendum (attach executed document)
• Schedule C: DIFC SCCs (if used; attach executed clauses)