International Deployment Addendum
Sector-specific terms for deployments outside the United States. Attaches to the MSA where a Site is located outside the U.S. or where Data Subjects are located outside the U.S.
1. Data residency
Personal Data originating in the following jurisdictions is stored and processed in the region shown, with fail-over in a second region within the same regulatory bloc:
- EEA — Frankfurt (primary), Dublin (failover).
- United Kingdom — London (primary), Manchester (failover).
- Canada — Toronto (primary), Montréal (failover).
- Australia / New Zealand — Sydney (primary), Melbourne (failover).
- Japan — Tokyo (primary), Osaka (failover).
- Singapore / SEA — Singapore (primary), Jakarta (failover).
- Brazil / LATAM — São Paulo (primary), Rio de Janeiro (failover).
- South Africa — Cape Town (primary), Johannesburg (failover).
2. EU Representative (GDPR Article 27)
WCE has appointed an EU Representative for the purposes of Article 27 GDPR. Contact details are published in the Privacy Policy and in the site footer. Requests to the EU Representative are treated as if made to WCE and are handled by the WCE DPO.
3. UK Representative (UK-GDPR)
WCE has appointed a UK Representative for the purposes of the UK-GDPR. Contact details are published in the Privacy Policy and in the site footer.
4. Standard Contractual Clauses
Cross-border transfers of Personal Data originating in the EEA are governed by the European Commission's Standard Contractual Clauses (Commission Decision 2021/914), Module 2 (Controller to Processor) or Module 3 (Processor to Processor) as applicable, incorporated by reference in the DPA. UK transfers are additionally governed by the UK International Data Transfer Addendum (Version B1.0, 2 February 2022).
5. Local law compliance
WCE, in cooperation with the Authority, shall comply with local requirements for the Coverage Area, including (as applicable): PIPEDA (Canada), the CPPA (upon coming into force), PIPL (China — WCE does not operate in mainland China), the Personal Information Protection Act (South Korea), the Personal Data Protection Act 2012 (Singapore), the Australian Privacy Act 1988, the New Zealand Privacy Act 2020, LGPD (Brazil), POPIA (South Africa), PDP Bill / DPDPA (India), and APPI (Japan).
6. Local supervisory-authority engagement
WCE shall cooperate with, and provide reasonable assistance in respect of, inquiries from a competent supervisory authority in the jurisdiction of the Coverage Area, including responding to information requests within the timeframe required by law.
7. Localisation of console and App
The operator console and the App are localised to the primary languages of each region of deployment. WCE will provide a WCAG 2.2 AAA-conformant translation on request, prioritised by number of Coverage Areas in the target language.
8. Cross-border evidentiary matters
Where a Chain-of-Custody Record is required to be produced in a cross-border proceeding, WCE will produce it in accordance with the Chain-of-Custody Rider and will, where necessary, cooperate with the Authority in a Hague Evidence Convention or Mutual Legal Assistance procedure.
9. Sanctions and export controls
Neither Party shall use the Platform to violate applicable sanctions law of the United States, the European Union, the United Kingdom, or the jurisdiction of the Coverage Area. WCE reserves the right to suspend a Coverage Area upon a good-faith determination that its continued operation would violate sanctions.
10. Order of precedence
In the event of a conflict with the body of the MSA, this Addendum governs to the extent required by local law of the Coverage Area.
This Addendum attaches to the MSA and is effective concurrently with it.