(Applicable ONLY if the Partner instructs Varnish to process Traffic Data outside the EEA in a country without an Adequacy Decision)
1. Incorporation of Standard Clauses
The Parties agree to enter into and apply the Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 (Module 3: Processor-to-Processor), as set forth in European Commission Implementing Decision (EU) 2021/914. The full official text of Module 3 is incorporated herein by reference and accessible at the official EU website https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj/eng
2. Annexes to the Standard Contractual Clauses
ANNEX I
A. List of Parties:
- Data Exporter: The Partner identified in the Partner Agreement / DPA (acting as Processor).
- Data Importer: Varnish Software AB (acting as Sub-processor).
B. Description of Transfer: The details of the processing operations, including data subjects, categories of personal data, nature, purpose, and retention periods are incorporated by reference and set forth in Varnish Data Processing Agreement (DPA).
C. Competent Supervisory Authority: The supervisory authority competent in accordance with Clause 13 of these Standard Contractual Clauses.
ANNEX II: TECHNICAL AND ORGANISATIONAL MEASURES
The technical and organizational security measures implemented by Varnish Software AB (the Data Importer) are maintained at https://www.varnish-cdn.com/legal/security-and-compliance
ANNEX III: LIST OF SUB-PROCESSORS
The authorized sub-processors, processing locations, and services provided are maintained at https://www.varnish-cdn.com/legal/privacy-policy