Cross Border Transfer Mechanisms

1. 1. Definitions
   • “EC” means the European Commission
   • “EEA” means the European Economic Area
   • “Standard Contractual Clauses” means, depending on the circumstances unique to Institution, any of the following:

   (b) 2021 Standard Contractual Clauses; and

   (b) UK Addendum.

   • “UK Addendum” means the International Data Transfer Addendum to the Standard Contractual Clauses, Version B1.0, issued by the Information Commissioner under s119A of the Data Protection Act 2018 and dated 21 March 2022.
   • “2021 Standard Contractual Clauses” means the Standard Contractual Clauses approved by the European Commission in decision 2021/914.
   2. Cross Border Data Transfer Mechanisms.

   2.1 Order of Precedence. In the event the transfers are covered by more than one Transfer Mechanism, the transfer of personal information will be subject to a single Transfer Mechanism in accordance with the following order of precedence: (a) the applicable Standard Contractual Clauses as set forth in Section 2.2 (The 2021 Standard Contractual Clauses) or Section 2.3 (UK Addendum) of this Schedule 3; and, if not applicable, then (b) other applicable data Transfer Mechanisms permitted under Applicable data protection law.

   2.2 2021 Standard Contractual Clauses. The parties agree that the 2021 Standard Contractual Clauses will apply to personal information that is transferred via the Services from the European Economic Area or Switzerland, either directly or via onward transfer, to any country or recipient outside the European Economic Area or Switzerland that is not recognized by the European Commission (or, in the case of transfers from Switzerland, the competent authority for Switzerland) as providing an adequate level of protection for personal information. For data transfers from the European Economic Area that are subject to the 2021 Standard Contractual Clauses, the 2021 Standard Contractual Clauses will be deemed entered into (and incorporated into this DPA by this reference) and completed as follows:

   (a) Module One (Controller to Controller) of the 2021 Standard Contractual Clauses will apply where (i) ApplyBoard is processing Student Data and (ii) Institution is a controller of Student Data and ApplyBoard is processing Student Data.

   (b) Where applicable:

   (i) in Clause 7 of the 2021 Standard Contractual Clauses, the optional docking clause will not apply;

   (ii) in Clause 9 of the 2021 Standard Contractual Clauses, Option 2 will not be applicable;

   (iii) in Clause 11 of the 2021 Standard Contractual Clauses, the optional language will not apply;

   (iv) in Clause 17 (Option 1), the 2021 Standard Contractual Clauses will be governed by Irish law;

   (v) in Clause 18(b) of the 2021 Standard Contractual Clauses, disputes will be resolved before the courts of Ireland;

   (vi) in Annex I, Part A of the 2021 Standard Contractual Clauses:

   Data Exporter: Institution

   Contact details: The email address(es) designated by Institution.

   Address: The address for Institution specified in the Partner Agreement.

   Data Exporter Role: The Data Exporter’s role is set forth in Section 3.2 (Processor’s Obligations) of this DPA.

   Signature and Date: By entering into this DPA, Data Exporter is deemed to have signed these Standard Contractual Clauses incorporated herein, including their Annexes, as of the Effective Date of the DPA.

   Data Importer: ApplyBoard 

   Contact details: ApplyBoard’s Privacy Office – DPO@applyboard.com.

   Address: The address for ApplyBoard specified in the Partner Agreement. 

   Data Importer Role: The Data Importer’s role is set forth in Section 3.1 (Controller’s Obligations) of this DPA.

   Signature and Date: By entering into this DPA, Data Importer is deemed to have signed these Standard Contractual Clauses, incorporated herein, including their Annexes, as of the Effective Date of the DPA.

   (vii) in Annex I, Part B of the 2021 Standard Contractual Clauses:

   The categories of data subjects are described in Schedule 1 (Details of Processing) of this DPA.

   The Sensitive Data transferred is described in Schedule 1 (Details of Processing) of this DPA.

   The frequency of the transfer is a continuous basis for the duration of the DPA.

   The nature of the processing is described in Schedule 1 (Details of Processing) of this DPA.

   The purpose of the processing is described in Schedule 1 (Details of Processing) of this DPA.

   The period for which the personal information will be retained is described in Schedule 1 (Details of Processing) of this DPA.

   (viii) in Annex I, Part C of the 2021 Standard Contractual Clauses: The Irish Data Protection Commission will be the competent supervisory authority.

   (ix) Schedule 2 (Technical and Organizational Security Measures) of this DPA serves as Annex II of the Standard Contractual Clauses.

   2.3 UK Addendum. The parties agree that the UK Addendum will apply to personal information that is transferred via the Services from the United Kingdom, either directly or via onward transfer, to any country or recipient outside of the United Kingdom that is not recognized by the competent United Kingdom regulatory authority or governmental body for the United Kingdom as providing an adequate level of protection for personal information. For data transfers from the United Kingdom that are subject to the UK Addendum, the UK Addendum will be deemed entered into (and incorporated into this DPA by this reference) and completed as follows:

   1. Table 1 will be populated with the information in Section 2.2(b)(vi) of Schedule 3 of this DPA; 
   2. In Table 2 of the UK Addendum, information about the version of the 2021 Standard Contractual Clauses, including the modules and selected clauses to which this UK Addendum is appended, is set out in Section 2.2(a) (2021 Standard Contractual Clauses) of Schedule 3 of this DPA; 
   3. Table 3 will be populated as follows: 
      1. Annex 1A – List of Parties: As set forth in Section 2.2(b)(vi) of Schedule 3 of this DPA.
      2. Annex 1B – Description of Transfer: As set forth in Schedule 1 (Details of the Processing) of this DPA. 
      3. Annex II – Technical and Organizations Security Measures: As set forth in Schedule 2 (Technical and Organizational Security Measures) of this DPA.
      4. Annex II – List of Sub processors: Not applicable.
   4. Table 4: The data importer may end the UK Addendum in accordance with the terms of the UK Addendum.