Haku
Book a demo
Data Processing Agreement

Annex IV — Transfer Mechanism

Haku Labs Ltd · Company number 16248507 ← Back to the DPA

This Annex forms part of, and is incorporated into, the Data Processing Agreement between the Controller and the Processor (the "DPA"), and gives effect to clause 6.2. Terms defined in the DPA have the same meaning in this Annex.

In accordance with clause 6.2 of the DPA, this Annex takes precedence over the DPA to the extent of any conflict, save in respect of Section 9 (Liability), which continues to apply to the maximum extent permitted by the Data Protection Laws.

1. Transfer Mechanism by Destination

1.1 The Parties are deemed to have entered into the mechanism identified below in respect of each transfer of Controller Personal Data to a Sub-processor listed in Annex III, section 2.

Destination
Mechanism
Sub-processors
United Kingdom
None required
Civo Cloud
European Economic Area
None required; the EEA is the subject of United Kingdom adequacy regulations
Hetzner Cloud, RunPod, Unipile
United States
The Approved EU Standard Contractual Clauses as amended by the International Data Transfer Addendum issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018, version B1.0, in force 21 March 2022
Maildoso, Twilio, Postmark, Stripe

1.2 Where a Sub-processor established in the United States participates in, and its certification covers the categories of Personal Data transferred under, the UK Extension to the EU-US Data Privacy Framework, the Processor may rely on that certification in place of the mechanism at paragraph 1.1. The Processor verifies certification and its scope on the Data Privacy Framework list rather than by reference to the vendor's own representations, and records the outcome in the register described in Annex II, paragraph 5.2. The Standard Contractual Clauses continue to apply as an additional safeguard.

1.3 No transfer of Controller Personal Data is made to any destination other than those identified in paragraph 1.1 without prior notification to the Controller in accordance with clause 5.4.2 of the DPA.

2. Module and Clause Selection

2.1 Module Two (controller to processor) applies to transfers of Controller Personal Data to the Sub-processors listed in Annex III, section 2. The Controller is the data exporter and the Sub-processor is the data importer. The Processor contracts with each data importer on the Controller's behalf under the general written authorisation given at clause 5.4.1 of the DPA.

2.2 Module One (controller to controller) applies where the Processor transfers Haku Sourced Data in its capacity as independent controller under clause 3.2 of the DPA, including to the vendors listed in Annex III, section 3.

2.3 The following optional provisions of the Approved EU Standard Contractual Clauses are selected or declined as set out below:

  • Clause 7 (docking clause): selected.
  • Clause 9 (use of sub-processors): Option 2, general written authorisation. The notification period is thirty (30) days, so as to align with clause 5.4.2 of the DPA.
  • Clause 11 (redress): the optional independent dispute resolution body is not selected.
  • Clause 17 (governing law): the law of England and Wales.
  • Clause 18 (choice of forum and jurisdiction): the courts of England and Wales.

3. International Data Transfer Addendum - Completed Tables

The following completes the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0.

Table
Entry
Table 1: Parties
Exporter: the Controller, as identified on the cover page of the DPA. Importer: each Sub-processor listed in Annex III, section 2, whose destination is outside the United Kingdom and the EEA. Contact details, roles and signatures are as set out in the DPA and in Annex III respectively.
Table 2: Selected SCCs, Modules and Selected Clauses
The Approved EU Standard Contractual Clauses, Module Two, with the optional provisions selected or declined as set out at paragraph 2.3 above.
Table 3: Appendix Information
Annex 1A (List of Parties): as Table 1. Annex 1B (Description of Transfer): Annex I of the DPA. Annex 1C (Competent Supervisory Authority): the Information Commissioner's Office. Annex II (Technical and Organisational Measures): Annex II of the DPA. Annex III (List of Sub-processors): Annex III of the DPA.
Table 4: Ending this Addendum when the Approved Addendum Changes
Neither Party may end this Addendum when the Approved Addendum changes.

4. Transfer Risk Assessments

4.1 The Processor conducts and documents a transfer risk assessment in respect of each transfer of Controller Personal Data to a country which is not the subject of a United Kingdom adequacy decision, addressing the laws and practices of the destination country concerning access to data by public authorities, the categories of Personal Data transferred, the circumstances of the transfer, and the technical, contractual and organisational supplementary measures applied.

4.2 Each assessment is reviewed at least annually, and on any material change to the transfer, the Sub-processor, or the legal position in the destination country.

4.3 Where an assessment concludes that the mechanism at paragraph 1.1 does not, together with any supplementary measures available, secure a level of protection essentially equivalent to that guaranteed within the United Kingdom, the Processor shall suspend the transfer and shall notify the Controller.

4.4 The Processor's assessments are made available to the Controller on reasonable request in accordance with clause 7.1 of the DPA.

5. Supplementary Measures

5.1 In addition to the mechanism at paragraph 1.1, the following supplementary measures apply to transfers of Controller Personal Data outside the United Kingdom and the EEA:

  • Encryption in transit using TLS, as described in Annex II, section 2.
  • Encryption at rest, and field-level encryption of credentials, as described in Annex II, section 2.
  • Minimisation of the Personal Data disclosed to each Sub-processor to that necessary for the purpose for which it is engaged, as described in Annex II, paragraph 3.5 and recorded in Annex III.
  • Use of a self-hosted inference model within the EEA, so that content generation involving Controller Personal Data does not give rise to a restricted transfer, as described in Annex II, paragraph 5.4.
  • A commitment by each Sub-processor to notify the Processor of any binding request from a public authority for disclosure of Controller Personal Data, and to challenge that request where lawful grounds exist to do so.

6. Onward Transfers Directed by the Controller

6.1 Where the Controller instructs the Processor to write Controller Personal Data to a system operated by or on behalf of the Controller, including a customer relationship management or enterprise system, that transfer is directed by the Controller and the Controller is responsible for the mechanism applicable to it.

Annex IV - Transfer Mechanism — Haku
Data Processing Agreement

Annex IV — Transfer Mechanism

Haku Labs Ltd · Company number 16248507 ← Back to the DPA

This Annex forms part of, and is incorporated into, the Data Processing Agreement between the Controller and the Processor (the "DPA"), and gives effect to clause 6.2. Terms defined in the DPA have the same meaning in this Annex.

In accordance with clause 6.2 of the DPA, this Annex takes precedence over the DPA to the extent of any conflict, save in respect of Section 9 (Liability), which continues to apply to the maximum extent permitted by the Data Protection Laws.

1. Transfer Mechanism by Destination

1.1 The Parties are deemed to have entered into the mechanism identified below in respect of each transfer of Controller Personal Data to a Sub-processor listed in Annex III, section 2.

Destination
Mechanism
Sub-processors
United Kingdom
None required
Civo Cloud
European Economic Area
None required; the EEA is the subject of United Kingdom adequacy regulations
Hetzner Cloud, RunPod, Unipile
United States
The Approved EU Standard Contractual Clauses as amended by the International Data Transfer Addendum issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018, version B1.0, in force 21 March 2022
Maildoso, Twilio, Postmark, Stripe

1.2 Where a Sub-processor established in the United States participates in, and its certification covers the categories of Personal Data transferred under, the UK Extension to the EU-US Data Privacy Framework, the Processor may rely on that certification in place of the mechanism at paragraph 1.1. The Processor verifies certification and its scope on the Data Privacy Framework list rather than by reference to the vendor's own representations, and records the outcome in the register described in Annex II, paragraph 5.2. The Standard Contractual Clauses continue to apply as an additional safeguard.

1.3 No transfer of Controller Personal Data is made to any destination other than those identified in paragraph 1.1 without prior notification to the Controller in accordance with clause 5.4.2 of the DPA.

2. Module and Clause Selection

2.1 Module Two (controller to processor) applies to transfers of Controller Personal Data to the Sub-processors listed in Annex III, section 2. The Controller is the data exporter and the Sub-processor is the data importer. The Processor contracts with each data importer on the Controller's behalf under the general written authorisation given at clause 5.4.1 of the DPA.

2.2 Module One (controller to controller) applies where the Processor transfers Haku Sourced Data in its capacity as independent controller under clause 3.2 of the DPA, including to the vendors listed in Annex III, section 3.

2.3 The following optional provisions of the Approved EU Standard Contractual Clauses are selected or declined as set out below:

  • Clause 7 (docking clause): selected.
  • Clause 9 (use of sub-processors): Option 2, general written authorisation. The notification period is thirty (30) days, so as to align with clause 5.4.2 of the DPA.
  • Clause 11 (redress): the optional independent dispute resolution body is not selected.
  • Clause 17 (governing law): the law of England and Wales.
  • Clause 18 (choice of forum and jurisdiction): the courts of England and Wales.

3. International Data Transfer Addendum - Completed Tables

The following completes the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0.

Table
Entry
Table 1: Parties
Exporter: the Controller, as identified on the cover page of the DPA. Importer: each Sub-processor listed in Annex III, section 2, whose destination is outside the United Kingdom and the EEA. Contact details, roles and signatures are as set out in the DPA and in Annex III respectively.
Table 2: Selected SCCs, Modules and Selected Clauses
The Approved EU Standard Contractual Clauses, Module Two, with the optional provisions selected or declined as set out at paragraph 2.3 above.
Table 3: Appendix Information
Annex 1A (List of Parties): as Table 1. Annex 1B (Description of Transfer): Annex I of the DPA. Annex 1C (Competent Supervisory Authority): the Information Commissioner's Office. Annex II (Technical and Organisational Measures): Annex II of the DPA. Annex III (List of Sub-processors): Annex III of the DPA.
Table 4: Ending this Addendum when the Approved Addendum Changes
Neither Party may end this Addendum when the Approved Addendum changes.

4. Transfer Risk Assessments

4.1 The Processor conducts and documents a transfer risk assessment in respect of each transfer of Controller Personal Data to a country which is not the subject of a United Kingdom adequacy decision, addressing the laws and practices of the destination country concerning access to data by public authorities, the categories of Personal Data transferred, the circumstances of the transfer, and the technical, contractual and organisational supplementary measures applied.

4.2 Each assessment is reviewed at least annually, and on any material change to the transfer, the Sub-processor, or the legal position in the destination country.

4.3 Where an assessment concludes that the mechanism at paragraph 1.1 does not, together with any supplementary measures available, secure a level of protection essentially equivalent to that guaranteed within the United Kingdom, the Processor shall suspend the transfer and shall notify the Controller.

4.4 The Processor's assessments are made available to the Controller on reasonable request in accordance with clause 7.1 of the DPA.

5. Supplementary Measures

5.1 In addition to the mechanism at paragraph 1.1, the following supplementary measures apply to transfers of Controller Personal Data outside the United Kingdom and the EEA:

  • Encryption in transit using TLS, as described in Annex II, section 2.
  • Encryption at rest, and field-level encryption of credentials, as described in Annex II, section 2.
  • Minimisation of the Personal Data disclosed to each Sub-processor to that necessary for the purpose for which it is engaged, as described in Annex II, paragraph 3.5 and recorded in Annex III.
  • Use of a self-hosted inference model within the EEA, so that content generation involving Controller Personal Data does not give rise to a restricted transfer, as described in Annex II, paragraph 5.4.
  • A commitment by each Sub-processor to notify the Processor of any binding request from a public authority for disclosure of Controller Personal Data, and to challenge that request where lawful grounds exist to do so.

6. Onward Transfers Directed by the Controller

6.1 Where the Controller instructs the Processor to write Controller Personal Data to a system operated by or on behalf of the Controller, including a customer relationship management or enterprise system, that transfer is directed by the Controller and the Controller is responsible for the mechanism applicable to it.