Soma1. EU hosting and transfers
EU hosting alone does not prevent an international transfer. Remote support, models, delivery services and backups must also be assessed. EUTS may process customer data only within agreed locations and access arrangements. Transfers requiring Chapter V GDPR safeguards need a valid mechanism before access starts.
2. Available mechanisms
A valid adequacy decision under Article 45 may apply to the actual recipient and destination. Otherwise appropriate Article 46 safeguards, often SCCs, and necessary supplementary measures are required. Reliance on a certification-based framework requires checking the exact recipient’s active certification, scope and current decision. This page does not claim that an unlisted recipient is certified or that a transfer assessment is complete.
3. Official text and correct modules
Use the unmodified applicable clauses from the Commission’s official SCC publications, including Decision (EU) 2021/914 where applicable. Controller-to-controller, controller-to-processor, processor-to-processor and processor-to-controller modules serve different roles. An EEA customer transferring to EUTS in Germany does not automatically need third-country SCCs.
Identify actual exporter/importer, check the instrument’s scope, select modules and options, and complete the party, transfer, security, supervision and sub-processor annexes. Record required law and court elections. A generic web link does not complete missing parties or annexes. Mandatory clause protections prevail.
4. Assessment and government access
Assess destination law and practice, data and access paths, and whether supplementary safeguards make the transfer lawful. Document minimisation, encryption and key access. If protection cannot be ensured, do not proceed or suspend the transfer. Government requests must be assessed, minimised and challenged where appropriate, with notice where lawful.
5. UK, Swiss and customer copies
UK or Swiss data may need their own lawful basis and addenda or adaptations; EU clauses alone are not universally sufficient. Complete the applicable documents for the arrangement. Request executed documents, safeguards and permitted supporting information at contact@euts.ai. The DPA does not deem uncompleted SCCs signed by linking here.
SomaHQ · EUTS UG (haftungsbeschränkt)
contact@euts.ai · Legal hub