Data processing — International transfers

RowFold is operated from the United States and all Customer Personal Data is stored there. There is no EU or UK data residency option. Using the Service therefore involves a transfer out of the EEA and the UK. Where Data Protection Law requires a transfer mechanism, the SCCs are incorporated into this DPA and apply as follows: Module Two (controller to processor) where you are a controller, and Module Three (processor to processor) where you are yourself a processor acting for another controller. For transfers subject to the UK GDPR, the SCCs apply as varied by the UK International Data Transfer Addendum. Where the SCCs require a selection, the parties agree: docking clause applies; option 2 general written authorisation for subprocessors, with the notice period in section 07; the governing law and forum are those of Ireland for EU transfers and of England and Wales for UK transfers; and Annexes I, II and III of the SCCs are populated by sections 13, 14 and 15 of this DPA respectively. If a transfer mechanism is invalidated, we will work with you in good faith to put a valid alternative in place.