DPA Annex D — International Transfers

This is an activation and completion schedule, not a self-executing substitute for mandatory statutory clauses. Counsel must check applicable laws, actual export/import flows, organization roles and vendor regions. If no restricted transfer is involved for a module, mark it Not Applicable with reasoning instead of incorporating boilerplate.

1. Verified transfer map (mandatory before signature)

2. Canada and Québec (conditional)

2.1 Where PIPEDA applies, the Parties will implement appropriate contractual/organizational protection and transparency for overseas processing; Customer's accountability and SiteAxis's processor obligations will be mapped by actual role and law. This does not create a blanket requirement for Canadian-only hosting.

2.2 Where Québec private-sector requirements apply, Customer and SiteAxis will determine who must perform an evaluation of privacy-related factors prior to a covered communication of personal information outside Québec, the required written agreement, applicable notice/consent and appropriate safeguards. Applicability/PIA/transfer sign-off: a privacy impact assessment completed before personal information of Québec residents is transferred outside Québec. Do not promise Québec-exclusive processing without an executed region commitment.

3. EU GDPR — restricted transfers (conditional)

Activation: Not currently applicable; completed only in a signed Order when required. For a transfer requiring the European Commission's international-transfer SCCs (Commission Implementing Decision (EU) 2021/914), the Parties must execute or validly incorporate their complete operative text, select appropriate Module Not applicable unless completed in a signed Order, name exporter/importer(s), describe transfers, select options and complete Annexes I, II and III with correct authorities and security measures. The GDPR Article 28 controller–processor clauses and international transfer SCCs are different instruments and neither should be confused with the other.

SCC document/version reference: Not applicable unless completed in a signed Order Parties/roles and authority: Not applicable unless completed in a signed Order Annexes/security and subprocessors: Not applicable unless completed in a signed Order Transfer impact/supplementary measures: Not applicable unless completed in a signed Order.

Official text: https://commission.europa.eu/publications/publications-standard-contractual-clauses-sccs_en . Do not rewrite mandatory SCCs based on the General Legal summary.

4. United Kingdom (conditional)

Activation: Not currently applicable; completed only in a signed Order when required. Counsel selects an effective UK International Data Transfer Agreement (IDTA) or legally valid UK Addendum to EU SCCs and completes all required tables and appended instruments: Not applicable unless completed in a signed Order. Verify applicable ICO guidance and law at signature; do not assume EU SCCs alone cover a UK restricted transfer. Official guidance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/ .

5. Switzerland (conditional)

Activation: Not currently applicable; completed only in a signed Order when required. Counsel validates whether Swiss law requires adapted standard clauses or another valid mechanism, documents the chosen supervisory authority, Swiss terminology/rights, lawful recipient and transfer map: Not applicable unless completed in a signed Order.

6. United States state privacy laws (conditional)

Activation: Assessed per customer; requests under a U.S. state privacy law can be sent to privacy@siteaxis.app. Where California or other U.S. state laws apply to particular data and roles, execute 23_US_STATE_PRIVACY_ADDENDUM.md with law-specific restrictions, assistance, notice, assessment, subcontracting, lawful retention and audit provisions. Do not apply California-specific sale/share terms to every B2B processing activity without analysis. Document Assessed per customer.

7. Supplemental measures and monitoring

Each Party will reasonably support needed assessments, government access request handling subject to law, technical protections, documented subprocessors and updates to mechanisms where invalidated. Any specific law-enforcement request notice or data-residency undertaking must reflect legal constraints and verified service capabilities.

Signed annex status: In effect for Canadian and U.S. processing; EU, UK and Swiss transfer instruments are signed only when required · Counsel: Internal record, available to customers on request.