EEA Standard Contractual Clauses

Last updated January 29, 2025

Standard Contractual Clauses (Processors)

The data controller, as defined in the Data Processing Agreement ("data exporter"),

And

Zenevo SRL, which is based in Romania, if the data exporter transfers personal data to Zenevo SRL pursuant to the Data Processing Agreement;

(the relevant Zenevo SRL entity described above is referred to as the "data importer"),

each a "party"; together the "parties",

HAVE AGREED to the following Contractual Clauses ("Clauses") in order to provide appropriate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer of personal data from the data exporter to the data importer as specified in Annex 1.

SECTION I

Clause 1 - Purpose and Scope

(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) for the transfer of personal data to a third country.

(b) The Parties:

  • (i) the natural or legal person(s), public authority/authorities, agency/agencies or other body/bodies which transfer the personal data, as listed in Annex I.A (each a ‘data exporter’), and
  • (ii) the entity/entities in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also party to these Clauses, as listed in Annex I.A (each a ‘data importer’).

(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.

(d) The Annex to these Clauses containing the Annexes referred to above forms an integral part of these Clauses.

Clause 2 - Effect and Invariability of the Clauses

(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Annex. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a broader contract and/or adding other clauses or additional safeguards, provided they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.

(b) These Clauses are without prejudice to the obligations to which the data exporter is subject under Regulation (EU) 2016/679.

Clause 3 - Third-Party Beneficiaries

(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:

  • (i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
  • (ii) Clause 8.1(b), 8.9(a), (c), (d) and (e);
  • (iii) Clause 9 – Clause 9(a), (c), (d) and (e);
  • (iv) Clause 12 – Clause 12(a), (d) and (f);
  • (v) Clause 13;
  • (vi) Clause 15.1(c), (d) and (e);
  • (vii) Clause 16(e);
  • (viii) Clause 18 – Clause 18(a) and (b);

(b) Paragraph (a) is without prejudice to the rights of data subjects under Regulation (EU) 2016/679.

Clause 4 - Interpretation

(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.

(b) These Clauses shall be read and interpreted in light of the provisions of Regulation (EU) 2016/679.

(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.

Clause 5 - Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 6 - Description of the Transfer(s)

The details of the transfer(s), and in particular the categories of personal data that are transferred and the purposes for which they are transferred, are specified in Annex I.B.

Clause 7 - Docking Clause

(a) An entity that is not a party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Annex and signing Annex I.A.

(b) Once it has completed the Annex and signed Annex I.A, the acceding entity shall become a party to these Clauses and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A.

(c) The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party.

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 8

Data Protection Safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organizational measures, to satisfy its obligations under these Clauses.

8.1 Instructions

(a) The data importer shall process the personal data only on documented instructions from the data exporter. The data exporter may give such instructions throughout the duration of the contract.

(b) The data importer shall immediately inform the data exporter if it is unable to follow those instructions.

8.2 Purpose Limitation

The data importer shall process the personal data only for the specific purposes of the transfer as set out in Annex I.B, unless it receives further instructions from the data exporter.

8.3 Transparency

Upon request, the data exporter shall provide the data subject with a copy of these Clauses, including the Annex completed by the Parties, free of charge. To the extent necessary to protect trade secrets or other confidential information, including personal data, the data exporter may redact part of the text of the Annex prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand the content or exercise their rights. Upon request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.

8.4 Accuracy

If the data importer becomes aware that the personal data it has received is inaccurate or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.

8.5 Duration of Processing and Erasure or Return of Data

Processing by the data importer shall take place only for the duration specified in Annex I.B. After the end of the provision of processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and ensure their deletion.