Data Transfer Addendum
This Data Transfer Addendum governs how personal data transfers from customers to August comply with international data protection regulations.
1. INTRODUCTION
1.1 This Data Transfer Addendum ("DTA") supplements and incorporates the Data Processing Addendum ("DPA") between customers and August for processing personal data ("DPA Data").
1.2 This DTA establishes the legal mechanisms for international data transfers required under applicable data protection laws, including the EU General Data Protection Regulation (GDPR), UK GDPR, and Swiss Federal Act on Data Protection (FADP).
1.3 Terms not defined herein have the meanings set forth in the DPA or Platform Agreement.
2. ORDER OF PRECEDENCE
2.1 When multiple transfer mechanisms apply, the following hierarchy governs:
(a) EU-U.S. Data Privacy Framework (and UK and Swiss Extensions) where applicable;
(b) UK International Data Transfer Addendum (for UK transfers);
(c) EEA Standard Contractual Clauses (Module 2: Controller to Processor);
(d) Swiss-specific mechanisms under the revised FADP;
(e) Other available lawful transfer mechanisms.
2.2 If any transfer mechanism becomes invalid or unenforceable, the parties shall rely on the next applicable mechanism in the hierarchy.
3. DATA PRIVACY FRAMEWORK
3.1 August maintains certification under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework.
3.2 August commits to notifying customers without undue delay if our Data Privacy Framework certification is withdrawn, invalidated, or otherwise rendered ineffective.
3.3 In such event, the parties shall rely on the Standard Contractual Clauses or other applicable transfer mechanisms.
4. STANDARD CONTRACTUAL CLAUSES (EU TRANSFERS)
4.1 For transfers of DPA Data from the European Economic Area to countries not subject to an adequacy decision, the parties incorporate Module 2 (Controller to Processor) of the Standard Contractual Clauses approved by European Commission Decision 2021/914.
4.2 The SCCs are completed as follows:
• Clause 7 (Docking clause): Applicable
• Clause 9 (Use of sub-processors): Option 2 (General written authorization)
• Clause 11 (Redress): Optional language not included
• Clause 17 (Governing law): Laws of Ireland
• Clause 18 (Choice of forum): Courts of Ireland
4.3 Annex I, II, and III details are set forth in the DPA.
5. UK AND SWISS TRANSFERS
5.1 UK Transfers: For transfers from the United Kingdom, the parties incorporate the UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the UK Information Commissioner's Office under S119A(1) Data Protection Act 2018.
5.2 The UK Addendum is completed with:
• Part 1: Tables 1-3 information per the DPA
• Part 2: Mandatory Clauses of the Approved Addendum
5.3 Swiss Transfers: For transfers from Switzerland, the SCCs apply with the following modifications:
• References to "GDPR" include the Swiss Federal Act on Data Protection (FADP)
• The competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner (FDPIC)
• References to "Member State" include Switzerland
6. DATA IMPORTER OBLIGATIONS
As data importer, August commits to the following obligations under the applicable transfer mechanisms:
6.1 Process DPA Data only in accordance with documented instructions from the data exporter.
6.2 Implement and maintain appropriate technical and organizational security measures as detailed in the Security Addendum.
6.3 Notify the data exporter of personal data breaches without undue delay and in any event within 72 hours of becoming aware.
6.4 Assist the data exporter in responding to data subject requests for access, rectification, erasure, restriction, portability, and objection.
6.5 Permit and contribute to audits conducted by the data exporter or an authorized auditor, subject to reasonable confidentiality requirements.
6.6 Ensure that persons authorized to process DPA Data have committed to confidentiality obligations.
Last updated: January 2026