FN1: Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision 2021/915.
FN4: The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses.
FN8: This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7.
FN11: The data importer may offer independent dispute resolution through an arbitration body only if it is established in a country that has ratified the New York Convention on Enforcement of Arbitration Awards.
FN12: As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative timeframe. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies.
Data exporter(s):
Name: | The entity identified as the “Teacher” in the Teacher Contract. |
Address: | The address for the Teacher associated with its Teach Platform account or as otherwise specified in the Teacher Contract. |
Contact person's name, position and contact details: | The contact details associated with the Teacher’s account, or as otherwise specified in the Teacher Contract. |
Activities relevant to the data transferred under these Clauses: | The activities specified in the Data Protection Annex of the Teach Contract. |
Signature and date: | By creating a Teach Platform account subject to the Teacher Contract, the data exporter will be deemed to have signed this Annex 1. |
Role (controller/processor): | Controller |
European representative name and contact information: | If applicable, as notified by the data exporter to the data importer in writing from time to time. |
Data importer(s):
Name: | Teach Digital Software L.L.C. (commercial license number 1018442) |
Address: | Office 1006,10th floor, single Business Tower, Shaikh Zayed Road, Dubai, UAE |
Contact person's name, position and contact details: | James Watts, Founder, james@teach.io. |
Activities relevant to the data transferred under these Clauses: | Data controller and supplier of the personal data to be processed by the data importer. |
Signature and date: | 23 March 2022 |
Role (controller/processor): | Controller |
European representative name and contact information: | PrighterGDPR-Rep by Maetzler Rechtsanwalts GmbH & Co KG Schellinggasse 3/10, 1010 Vienna, Austria https://prighter.com/q/15256454505 |
Categories of data subjects whose personal data is transferred
Categories of data subject are specified in the Data Protection Annex of the Teacher Contract.
Categories of personal data transferred
The personal data is described in the Data Protection Annex of the Teacher Contract.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
The data exporter might include sensitive personal data in the personal data described in the Data Protection Annex of the Teacher Contract.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
Personal data is transferred in accordance with the Teacher’s instructions as described in the Data Protection Annex of the Teacher Contract.
Nature of the processing
The nature of processing is described in the Data Protection Annex of the Teacher Contract.
Purpose(s) of the data transfer and further processing
To provide the services described in the Teacher Contract.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
The retention period for the personal data is specified in the Data Protection Annex of the Teacher Contract.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
The subject matter, nature and duration of the processing are described in the Data Protection Annex of the Teacher Contract.
Identify the competent supervisory authority/ies in accordance with Clause 13
The data exporter’s competent supervisory authority will be determined in accordance with GDPR.
Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.
The technical and organisational measures as well as the scope and the extent of the assistance required to respond to data subject’ requests are described in the Data Protection Annex of the Teacher Contract.
For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter.
The technical and organisational measures that the data importer will impose on sub-processors are described in the Data Protection Annex of the Teacher contract.