Data Transfer Addendum
Important: This is a review copy. The parties must complete the selected locations, data flows, legal mechanisms, and any required Standard Contractual Clause annexes for the engagement.
Purpose and relationship to the DPA
This Data Transfer Addendum forms part of the applicable Data Processing Agreement. It records where customer personal data is hosted or otherwise processed and the safeguards used when processing involves a country outside the European Economic Area.
If this addendum conflicts with the DPA on an international-transfer matter, this addendum controls for that matter.
Default hosting location
Auditbahn-controlled systems are hosted on Hetzner infrastructure in Falkenstein, Germany by default. This default concerns the selected infrastructure location. It does not, by itself, state that every person, provider, support activity, or remote-access event involved in the service is located within the EEA.
The service-provider schedule identifies the providers and processing routes actually used for the engagement.
Alternative locations
A customer may request another available hosting location. Available options may include EEA locations, United States locations, and other locations outside the EEA. The selected location must be recorded in the order, statement of work, service-provider schedule, or another documented customer instruction before customer data is placed there.
A requested non-EEA location may change the transfer analysis, applicable law, provider terms, latency, and available safeguards. Auditbahn and the customer must document those effects before the location is used.
Transfer mechanisms
Where personal data protected by the GDPR is transferred outside the EEA, the parties identify an applicable legal mechanism before the transfer. Depending on the recipient and destination, this may include an adequacy decision, the European Commission Standard Contractual Clauses, or another mechanism permitted by applicable law.
Where the Standard Contractual Clauses are used, the parties complete the applicable module and annexes, including the parties, transfer description, data subjects, data categories, purpose, frequency, retention approach, competent supervisory authority, subprocessors, and technical and organisational measures.
Transfer assessment and supplementary measures
The parties assess whether the laws and practices applicable to a transfer could affect the safeguards used. Where needed, they document supplementary contractual, technical, or organisational measures appropriate to the data, destination, providers, and access model.
The customer is responsible for the transfer arrangements of systems and providers it selects and contracts directly. Auditbahn remains responsible for documenting transfers involving its own subprocessors.
Location changes
Auditbahn will not treat a non-EEA location as the default. A customer-requested location change must be documented, and the service-provider schedule and this addendum must be updated where the change affects the recorded data flow or transfer safeguard.
Request an engagement copy
Contact [email protected] to complete the DTA for a proposed or active engagement.