On this page

1. Introduction
2. Roles of the Parties
3. Cross-Border Data Transfer Mechanisms
4. Conflict
5. Definitions

Exhibit A (Description of Processing and Transfers)

1.Introduction.

This Supplier Data Transfers Addendum (SDTA), which governs Suppliers Processing of Personal Data, is incorporated by reference into the Data Processing Agreement (DPA) between Stripe and Supplier. Any capitalized terms not defined in this Supplier Data Transfers Addendum have the meanings given to them in the DPA or Agreement.

2. Roles of the Parties.

2.1 Supplier as a Data Processor of Stripe Data.

Supplier may Process Stripe Processor Data only as necessary to provide the Services. For the Processing of Stripe Processor Data, Stripe is a Data Controller, and Supplier is a Data Processor or Sub-processor acting on Stripes behalf. Where Supplier Processes Stripe Processor Data, it will do so only according to Stripes instructions set out in Section 2 of the DPA (Instructions), an SOW (if any), the Agreement, and this SDTA.

2.2 Supplier as a Data Controller of Stripe Data.

Supplier may Process Stripe Controller Data only as necessary to provide the Services. For the Processing of Stripe Controller Data, Stripe is a Data Controller, and Supplier is an independent Data Controller, not a joint Data Controller with Stripe. Where Supplier Processes Stripe Controller Data, it will do so only as: (a) set out in an SOW (if any) and the Agreement and necessary to provide the Services; and (b) necessary to comply with Law or DP Law.

2.3 Stripe and Supplier as Independent Data Controllers of Supplier Data.

For the Processing of Supplier Data, Supplier is a Data Controller, and Stripe is an independent Data Controller, not a joint Data Controller with Supplier. Stripe will Process Supplier Data as DP Law permits and according to Stripes Privacy Policy, the Agreement, the DPA, and this SDTA.

3. Cross-Border Data Transfer Mechanisms.

3.1 Order of Precedence.

If Supplier has certified its participation under the Data Privacy Framework (as recorded on the Data Privacy Framework website accessed here), then subsections (a) - (c) of this Section 3.1 apply:

(a) If, in connection with the Agreement, more than one Data Transfer Mechanism could apply to a transfer of Personal Data, the Parties agree that the transfer will be subject to one Data Transfer Mechanism only, according to the following order of precedence:

(i) the Data Privacy Framework;

(ii) the EU Standard Contractual Clauses;

(iii) the UK Data Transfer Addendum; and

(iv) Any other data transfer mechanism available under DP Law that is incorporated into the DPA, including this Supplier Data Transfers Addendum.

(b) Supplier is self-certified under the Data Privacy Framework. If EEA/UK/Swiss Data is transferred to Supplier, Supplier will receive the Personal Data under the Data Privacy Framework and, when Processing that Personal Data, will comply with the data privacy principles and relevant supplemental principles stated in the Data Privacy Framework.

(c) Supplier will promptly notify Stripe in writing at privacy@stripe.com if Suppliers self-certification under the Data Privacy Framework is withdrawn, terminated, revoked, or otherwise invalidated (in which case, an alternative Data Transfer Mechanism will apply).

3.2 The EU Standard Contract Clauses.

For transfers of Personal Data from the EEA to any jurisdiction that is not recognized as having an adequate level of protection for Personal Data under DP Law, the EEA Standard Contractual Clauses apply, are incorporated into this SDTA, and are completed as follows:

(a) Module One of the EEA Standard Contractual Clauses shall apply to the extent Stripe and Supplier, as independent controllers, process Supplier Data originating in the European Economic Area.

(b) Module Two of the EEA Standard Contractual Clauses shall apply to the extent Stripe transfers Stripe Processor Data to Supplier under the Agreement.

(c) For each Module, where applicable:

(i) The optional docking clause of Clause 7 shall not apply;

(ii) Option 2 of Clause 9 shall apply, and the time period for prior notice shall be as set forth in the DPA.

(iii) The optional language in Clause 11 shall not apply;

(iv) Option 1 will apply in Clause 17 and the EEA Standard Contractual Clauses shall be governed by Irish law;

(v) Under Clause 18, all disputes shall be resolved before the courts of Ireland;

(vi) Annex I of the EEA Standard Contractual Clauses shall be deemed completed as set out in Exhibit A of this SDTA.

(vii) Annex II of the EEA Standard Contractual Clauses shall be deemed completed as set out in Exhibit A of the DPA.

3.3 The UK International Data Transfer Addendum.

For all transfers of Personal Data from the UK to any jurisdiction that is not recognized as having an adequate level of protection for Personal Data under DP Law, the UK Data Transfer Addendum applies, is incorporated into this DPA, and is completed as follows:

(a) The data exporter and importer shall be as set out in Sections 2 and 3.2 of this SDTA;

(b) Table 1 of the UK Data Transfer Addendum is deemed to be populated with the information set out in Section 2 of this SDTA, the underlying Agreement, and Exhibit A of the DPA, as applicable;

(c) For purposes of Table 2 of the UK Data Transfer Addendum, the version of the Approved EU SCCs (including the appendix information, modules, and selected clauses) appended to the UK Data Transfer Addendum is the EEA Standard Contractual Clauses, as supplemented by Sections 2 and 3.2(a-c) of this SDTA.

(d) Table 3 of the UK Data Transfer Addendum is deemed to be populated with the information set out in Exhibit A of the SDPA and Exhibit A of this SDTA, as applicable;

(e) For purposes of Table 4 of the UK Data Transfer Addendum, the importer and exporter options shall apply;

(f) Under Part 2, the mandatory clauses of the UK Data Transfer Addendum will apply; and

(g) By entering into this Agreement, the data importer and data exporter are deemed to have signed the UK Data Transfer Addendum, as of the DPA Effective Date.

3.4 Personal Data Transfers from Switzerland.

For all data transfers from Switzerland to any jurisdiction that is not recognized as having an adequate level of protection for Personal Data under DP Law, the EEA Standard Contractual Clauses, as outlined in Section 3.2 and as supplemented as follows, apply:

(a) Any reference to Member State will not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland); and

(b) To the extent the transfer of Personal Data is governing by the Swiss Federal Act on Data Protection, the Swiss Federal Data Protection and Information Commissioner will act as the competent supervisory authority; to the extent the transfer of data is governing by the GDPR, the supervisory authority set forth in Exhibit A of this SDTA will act as the competent supervisory authority; and any references to the competent supervisory authority will be interpreted accordingly.

3.5 Personal Data Transfers from Thailand.

The EEA SCCs, supplemented by this Data Transfers Addendum and adapted as follows, applies to a transfer of Personal Data by the Parties that is subject to the Personal Data Protection Act B.E. 2562 (PDPA) to any jurisdiction that does not, for the purposes of the PDPA, have adequate Personal Data protection standards, and is Processed under the Agreement:

(a) Any reference to applicable laws will be interpreted to include the PDPA; and

(b) References to the European Union, Union, EU, EU Member State, Member State and EU or Member State are replaced with Thailand.

3.6 Personal Data Transfers from Brazil.

The Brazilian Standard Contractual Clauses (Brazilian SCCs), supplemented by this SDTA and adapted as set out in Sections 2 and 3.2 of this SDTA, as well as Exhibit A of this SDTA, apply to the transfer of Personal Data subject to the Brazilian General Data Protection Law (LGPD), from Brazil to a third country or territory without an adequacy decision from the Brazilian National Data Protection Authority.

3.7 Personal Data Transfers from CBPR Participating Economies.

Stripe Processes Personal Data in accordance with the Cross-Border Privacy Rules (CBPR) framework. Where CBPR is recognized as a valid transfer mechanism under DP Law, Stripe will transfer Personal Data in accordance with the CBPR and PRP certifications SINC has obtained.

3.8 Supplemental Clauses to the EEA Standard Contractual Clauses.

As applicable to the Processing under the Agreement, Supplier will comply with the supplemental terms of the EEA Standard Contractual Clauses as set forth in Annex IV of this SDTA.

3.9. Personal Data transfers from the United Arab Emirates (UAE)

3.9.1 UAE onshore. The EEA SCCs, supplemented by this Supplier Data Transfers Addendum and adapted as set out below, applies to a transfer of Personal Data that is subject to the United Arab Emirates (UAE) Federal DecreeLaw No. 45 of 2021 on the Protection of Personal Data (PDPL). The EEA SCCs shall apply as applicable and be amended to comply with all PDPL requirements for such transfers, including:

1. The "competent supervisory authority" and "supervisory authority" shall be replaced with the "applicable UAE supervisory authority".
2. References to "Regulation (EU) 2016/679", "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)" and "that Regulation" are all replaced by "the UAE's Personal Data Protection Law". References to specific Article(s) of "Regulation (EU) 2016/679" are replaced with the equivalent Article or Section of the UAE's Personal Data Protection Law.
3. References to Regulation (EU) 2018/1725 shall be omitted.
4. References to the "European Union", "Union", "EU", "EU Member State", "Member State" and "EU or Member State" are all replaced with the "United Arab Emirates".
5. The reference to "Clause 12(c)(i)" at Clause 10(b)(i) of Module 1 is replaced with "Clause 11(c)(i)".
6. Clause 13(a) and Part C of Annex I are not used and shall be omitted.
7. Clause 16(c) is supplemented by: "(iv) a UAE supervisory authority makes regulations that cover the transfer of personal data to which these Clauses apply;".
8. Clause 17 is replaced with: "These Clauses are governed by the federal laws of the UAE."
9. Clause 18 is replaced with: "Any dispute arising from these Clauses shall be resolved by the courts of the UAE. The Parties agree to submit themselves to the jurisdiction of such courts."

3.9.2 Financial Free Zones. The provisions in this Section 3.8.2 apply solely if and to the extent that the Personal Data is subject to the data protection laws of the Abu Dhabi Global Market (ADGM) or Dubai International Financial Centre (DIFC):

(a) ADGM. The standard data protection clauses of the ADGM Addendum to the EU Commission Standard Contractual Clauses shall in addition to the EEA SCCs and this Data Transfer Addendum apply to the transfer of Personal Data (subject to the ADGM Data Protection Regulations 2021) to a third country if such third country is not subject to an adequacy decision by the ADGM Commissioner of Data Protection.

(b) DIFC. The DIFC Standard Data Protection Contractual Clauses shall apply to the transfer of Personal Data (subject to the DIFC Data Protection Law no. 5 of 2020) to a third country if such third country is not subject to an adequacy decision by the DIFC Commissioner of Data Protection.

4. Conflict.

If there is any conflict or ambiguity between the provisions of the SDTA, the DPA, or any provision contained in the EEA Standard Contractual Clauses or the UK Data Transfer Addendum, as applicable, the provisions of the EEA Standard Contractual Clauses or the UK Data Transfer Addendum, as applicable, will prevail.

5. Definitions.

All capitalized terms not otherwise defined in this SDTA have the meanings set out in the Statement of Work or Agreement, including the DPA.

Data Privacy Framework means, as applicable, the EU-US, Swiss-US, or UK-US Data Privacy Framework self-certification program operated by the US Department of Commerce.

EEA/UK/Swiss Data means Personal Data about a Data Subject that is transferred from the European Economic Area, Switzerland or the United Kingdom.

EEA Standard Contractual Clauses mean Module 2 (Transfer: Controller to Processor) of the standard contractual clauses set out in the European Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countries pursuant to the GDPR, as amended or replaced from time to time by a competent authority under the relevant DP Law.

GDPR means the General Data Protection Regulation (EU) 2016/679, as amended or replaced from time to time.

UK Data Transfer Addendum means the international data transfer addendum to the EEA Standard Contractual Clauses issued by the UK Information Commissioner in accordance with section 119A of the UK Data Protection Act 2018, as amended or replaced from time to time by a competent authority under DP Law.

UK GDPR means the GDPR, as transposed into United Kingdom national law by operation of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019, as amended or replaced from time to time.

Exhibit A (Description of Processing and Transfers).