RYPT Data Processing Agreement
Last modified: 9th November,2026 · Version 1.0
1. Parties and scope
1.1 This Data Processing Agreement (“DPA”) is between Flamenco IL Holdings Limited, trading as RYPT, company number 620421, of 6 The Crescent, Galway, Ireland, H91 NHP3 (“RYPT”) and the customer that has accepted the RYPT Customer Terms of Use or signed an Order Form referring to them (“Customer”).
1.2 This DPA forms part of the agreement between RYPT and Customer (the “Agreement”) and applies to all processing of Customer Personal Data by RYPT in providing the Services. It takes effect on the date Customer accepts the Agreement, or on the date of signature where signed separately.
1.3 Customers who require a signed copy may complete the signature block at the end of this DPA and return it to [hello@rypt.app]. RYPT will countersign and return it within 10 business days. A signed copy has the same terms as the published version unless an Order Form says otherwise.
1.4 If this DPA conflicts with the Customer Terms of Use on a data protection matter, this DPA prevails. If it conflicts with the Standard Contractual Clauses or the UK Addendum in Annex IV, those prevail to the extent of the conflict.
2. Definitions
Capitalised terms not defined here have the meaning given in the Customer Terms of Use. “Controller”, “processor”, “data subject”, “personal data”, “processing”, “personal data breach”, “supervisory authority” and “special categories of personal data” have the meanings in the GDPR.
Customer Personal Data means personal data contained in Customer Data that RYPT processes on Customer’s behalf, including End User Data and personal data relating to Trainers that Customer submits in administering its Gym.
Data Protection Law means the GDPR, the Irish Data Protection Acts 1988 to 2018, the UK GDPR and the UK Data Protection Act 2018 (together “UK Data Protection Law”) where Customer is established in the UK or the processing is otherwise subject to them, and any other law applicable to the processing of Customer Personal Data under the Agreement.
EEA means the European Economic Area.
Standard Contractual Clauses or SCCs means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Decision (EU) 2021/914, as set out in Annex IV.
Sub-processor means any third party engaged by RYPT to process Customer Personal Data on RYPT’s behalf.
UK Addendum means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under s.119A of the Data Protection Act 2018, as set out in Annex IV.
3. Roles of the parties
3.1 Customer is the controller of Customer Personal Data and RYPT is its processor. Where Customer is itself acting as a processor for another organisation (for example, a coaching company serving a club), Customer warrants that it has that organisation’s authorisation to appoint RYPT as a sub-processor on these terms, and RYPT’s obligations under this DPA are owed to Customer only.
3.2 RYPT is an independent controller of personal data it processes for its own purposes: account administration for Customer and its Trainers, billing, support, security, service communications, marketing to Customer, and aggregated usage statistics as described in the Customer Terms of Use. That processing is governed by RYPT’s Privacy Policy [https://www.rypt.app/privacy-policy], not this DPA.
3.3 Annex I describes the subject matter, duration, nature and purpose of the processing, the categories of data subjects and the categories of Customer Personal Data, including special categories.
4. Customer’s obligations
4.1 Customer is responsible for compliance with Data Protection Law in its collection and use of Customer Personal Data, and warrants that it has, and will maintain for the duration of the Agreement:
- a lawful basis under Article 6 GDPR for each processing purpose, and a condition under Article 9(2) GDPR for the processing of health data (including injury, wellness, readiness, body composition and menstrual cycle data) through the Services;
- where Customer relies on consent, consent that meets Articles 7 and 9(2)(a) GDPR and, for data subjects below the applicable digital age of consent, the verifiable consent of a parent or guardian under Article 8 GDPR;
- a privacy notice provided to End Users and Trainers that satisfies Articles 13 and 14 GDPR and identifies RYPT as a processor;
- a record of processing activities under Article 30 GDPR where required; and
- a data protection impact assessment under Article 35 GDPR where Customer’s processing requires one, with RYPT’s assistance under clause 10.
4.2 Customer’s instructions to RYPT are: the Customer Terms of Use, this DPA, Customer’s and its Users’ use of the Services’ features and settings, and any further written instructions agreed between the parties. Customer warrants that its instructions comply with Data Protection Law.
4.3 Customer will not submit to the Services any personal data that is not described in Annex I, in particular genetic or biometric data used for identification, criminal offence data, or data relating to sexual orientation, religion, political opinion or trade union membership, unless the parties have agreed in writing.
4.4 Customer is responsible for configuring the Services, including Trainer permissions, End User connections, data-sharing settings and export and deletion of Customer Personal Data using the tools RYPT provides.
5. RYPT’s obligations (Article 28(3) GDPR)
5.1 Instructions. RYPT will process Customer Personal Data only on Customer’s documented instructions under clause 4.2, including with regard to transfers to a third country, unless required to do otherwise by EU or Member State law to which RYPT is subject. In that case RYPT will inform the Customer of the legal requirement before processing, unless the law prohibits this on important grounds of public interest. RYPT will inform the Customer without delay if, in RYPT’s opinion, an instruction infringes Data Protection Law; RYPT may suspend the instruction until Customer confirms or withdraws it.
5.2 Confidentiality of personnel. RYPT will ensure that each person it authorises to process Customer Personal Data is bound by a contractual or statutory duty of confidentiality, has received appropriate data protection and security training, and accesses Customer Personal Data only to the extent needed to perform their role.
5.3 Security. RYPT will implement and maintain the technical and organisational measures in Annex II, and will not materially reduce the overall level of protection during the Subscription Term. RYPT may update Annex II from time to time provided the overall protection is not reduced.
5.4 Sub-processors. RYPT will engage Sub-processors only in accordance with clause 6.
5.5 Assistance. RYPT will assist Customer as set out in clauses 9 and 10.
5.6 Deletion and return. RYPT will delete or return Customer Personal Data as set out in clause 12.
5.7 Demonstrating compliance. RYPT will make available the information necessary to demonstrate compliance with Article 28 GDPR and allow for audits as set out in clause 11.
5.8 No sale or secondary use. RYPT will not sell Customer Personal Data, use it to train models or build profiles for any purpose other than providing the Services to Customer, or use it for advertising.
6. Sub-processors
6.1 General authorisation. Customer gives RYPT general written authorisation to engage the Sub-processors listed in Annex III and published at [https://www.rypt.app/sub-processors], and to engage new or replacement Sub-processors in accordance with this clause.
6.2 Notice of changes. RYPT will give Customer at least 30 days’ notice before a new Sub-processor begins processing Customer Personal Data, by updating the published list and by email to Customer’s account owner. Customer may subscribe to notifications on the published page.
6.3 Objection. Customer may object in writing within the notice period on reasonable data-protection grounds. The parties will discuss the objection in good faith. If RYPT cannot offer a reasonable alternative within 30 days, Customer may terminate the affected Services on written notice and RYPT will refund prepaid Fees for the unused period. If Customer does not object within the notice period, the Sub-processor is authorised.
6.4 Flow-down. RYPT will enter into a written agreement with each Sub-processor imposing data protection obligations no less protective than those in this DPA, including appropriate security measures and, where the Sub-processor is outside the EEA or UK, a valid transfer mechanism under clause 7.
6.5 Responsibility. RYPT remains fully liable to Customer for the performance of each Sub-processor’s obligations.
6.6 Emergency replacement. Where RYPT must replace a Sub-processor urgently to maintain security or continuity of the Services, RYPT will notify Customer as soon as practicable and the objection right in clause 6.3 applies from the date of that notice.
7. International transfers
7.1 Location. RYPT stores Customer Personal Data at rest in Microsoft Azure data centres in the EEA (West Europe region, Netherlands). RYPT will not transfer Customer Personal Data outside the EEA or UK except as described in this clause and Annex III.
7.2 Permitted transfers. Where a Sub-processor processes Customer Personal Data in a country that has not received an adequacy decision under Article 45 GDPR (or the UK equivalent), RYPT will ensure the transfer is covered by: (a) the Sub-processor’s certification under the EU-US Data Privacy Framework (and the UK Extension) where applicable; or (b) the SCCs (and the UK Addendum for UK transfers), together with a transfer impact assessment and any supplementary measures required.
7.3 Customer transfers. Where Customer is established outside the EEA and UK and accesses Customer Personal Data from a third country, Customer is responsible for the lawfulness of that access. Where Customer is established in the EEA or UK and RYPT’s processing involves a restricted transfer, the SCCs in Annex IV apply between the parties with Customer as data exporter and RYPT as data importer.
7.4 Changes in law. If a transfer mechanism relied on under this clause is invalidated, RYPT will promptly implement an alternative lawful mechanism or cease the affected transfer.
8. Security
8.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk to data subjects, RYPT will implement and maintain the technical and organisational measures in Annex II to ensure a level of security appropriate to the risk, as required by Article 32 GDPR.
8.2 RYPT maintains an information security management system aligned with ISO/IEC 27001 and will make its current certificate or statement of applicability available to Customer on request under clause 11.
8.3 Customer acknowledges that the Services allow Customer to configure security-relevant settings, including Trainer permissions and End User data-sharing settings, and that Customer is responsible for those configurations and for the security of its own and its Users’ devices and credentials.
9. Personal data breaches
9.1 RYPT will notify Customer without undue delay, in accordance with the company’s Data Breach Response Policy [https://www.rypt.app/data-breach-response-policy], after becoming aware of a personal data breach affecting Customer Personal Data. Notice will be sent by email to Customer’s account owner and any data protection contact Customer has registered.
9.2 The notice will include, to the extent known at the time and updated as RYPT learns more: the nature of the breach including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact point. RYPT may provide the information in phases where it is not all available at once.
9.3 RYPT will take reasonable steps to contain and remedy the breach, will cooperate with Customer’s investigation, and will provide the information Customer reasonably needs to meet its own obligations under Articles 33 and 34 GDPR.
9.4 RYPT’s notification of, or response to, a breach is not an admission of fault or liability.
9.5 Customer is responsible for any notification to a supervisory authority or to data subjects. RYPT will not notify a supervisory authority or data subjects on Customer’s behalf unless required by law or agreed in writing.
10. Assistance to Customer
10.1 Data subject requests. RYPT will, taking into account the nature of the processing, assist Customer by appropriate technical and organisational measures in responding to requests from data subjects to exercise their rights under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection). The Services include tools that allow Customer and End Users to view, correct, export and delete Customer Personal Data; RYPT will provide further assistance on written request where those tools are not sufficient.
10.2 Requests received by RYPT. If RYPT receives a request from a data subject relating to Customer Personal Data, RYPT will not respond except to direct the data subject to Customer, and will notify Customer within 5 business days. RYPT will respond directly only where the request concerns data for which RYPT is the controller, or where required by law.
10.3 DPIAs and consultation. RYPT will provide reasonable assistance to Customer with data protection impact assessments and with prior consultation of a supervisory authority under Articles 35 and 36 GDPR, to the extent they relate to the Services, including by providing the information in Annexes I to IV and answering reasonable written questions.
10.4 Regulatory enquiries. RYPT will notify Customer, where legally permitted, if a supervisory authority or other authority makes a request or demand relating to Customer Personal Data, and will cooperate with Customer’s response.
10.5 Costs. Assistance under this clause is included in the Fees where it is reasonable in scope and frequency. RYPT may charge its standard professional services rates, agreed in advance, for assistance that is excessive, repetitive, or arises from Customer’s breach of this DPA or Data Protection Law.
11. Audits and information
11.1 Information. On written request, no more than once in any 12-month period unless a breach has occurred or a supervisory authority requires it, RYPT will provide Customer with: its current ISO/IEC 27001 certificate or equivalent, a summary of its most recent penetration test, completed responses to Customer’s reasonable security questionnaire, and such other information as is reasonably necessary to demonstrate compliance with this DPA.
11.2 Audit. Where the information under clause 11.1 is not sufficient to demonstrate compliance, or following a confirmed personal data breach affecting Customer Personal Data, or where a supervisory authority requires it, Customer or an independent auditor appointed by Customer and bound by confidentiality may audit RYPT’s compliance with this DPA, on at least 30 days’ written notice, during business hours, no more than once in any 12-month period, and in a manner that does not unreasonably disrupt RYPT’s operations or compromise the security or confidentiality of other customers’ data.
11.3 Scope and cost. The audit will be limited to RYPT’s facilities, systems and records relevant to Customer Personal Data. Audits of Sub-processors are conducted through the audit rights RYPT holds under its Sub-processor agreements. Each party bears its own costs, except that Customer will reimburse RYPT’s reasonable costs where the audit is not triggered by a breach or a regulator and takes more than one business day.
11.4 Findings. Customer will share audit findings with RYPT and the parties will agree a reasonable plan to remedy any material non-compliance identified.
12. Deletion and return of data
12.1 During the term. Customer may delete Customer Personal Data at any time using the Services’ tools. Data deleted this way is removed from production systems.
12.2 Export. For 30 days after termination or expiry of the Agreement, Customer may export Customer Personal Data using the Services’ export tools or by written request, in a commonly used machine-readable format.
12.3 Deletion. On the Customer’s written instruction, RYPT can delete all Customer Content and all copies of Customer Personal Data held for Customer’s Gym (subject to clause 12.5) within 30 days and will delete it from backups within a further 90 days, unless EU, Member State or UK law requires RYPT to retain it, in which case RYPT will retain only what is required, keep it confidential, and process it only for that purpose. RYPT will confirm deletion in writing on request.
12.4 Sub-processors. RYPT will ensure Sub-processors delete Customer Personal Data on the same basis.
12.5 End User accounts. End User accounts exist independently of Customer’s Gym. When an End User unlinks from the Gym, or when the Agreement ends, Customer’s access to that End User’s Customer Personal Data ends and the data remains in the End User’s own account, accessible only to the End User. From that point RYPT processes it as controller under the End User Terms and RYPT’s Privacy Policy [https://www.rypt.app/privacy-policy], and clause 12.3 does not require its deletion. Customer is responsible for exporting any records it needs to retain while the End User is still connected.
13. Liability
13.1 Each party’s liability arising out of or in connection with this DPA is subject to the exclusions and limitations in the Customer Terms of Use, including the separate cap for data protection claims. For clarity, the caps in the Customer Terms of Use apply in aggregate across the Terms and this DPA, not separately to each.
13.2 Nothing in this DPA limits a party’s liability where that would be unlawful, or affects either party’s direct liability to data subjects or supervisory authorities under Data Protection Law.
13.3 Where the SCCs apply, nothing in this clause limits the rights of data subjects under the SCCs.
14. Term and general
14.1 Term. This DPA takes effect under clause 1.2 and continues until RYPT has deleted all Customer Personal Data under clause 12.
14.2 Changes. RYPT may update this DPA to reflect changes in Data Protection Law, regulatory guidance or the Services, on at least 30 days’ notice to Customer, provided the overall level of protection is not reduced. Other changes require agreement in writing. Changes to Annex II and Annex III are governed by clauses 5.3 and 6.
14.3 Governing law. This DPA is governed by the laws of Ireland and the courts of Ireland have exclusive jurisdiction, except as provided in the SCCs and UK Addendum.
14.4 Severability. If any provision is invalid or unenforceable, it will be modified to the minimum extent needed and the rest of the DPA continues in effect.
14.5 Contacts. Customer may contact RYPT on data protection matters at [hello@rypt.app]. Customer will register a data protection contact in its account settings; RYPT will send breach and Sub-processor notices to that contact and to the account owner.
Annex I — Description of processing
This Annex also serves as Annex I.B of the SCCs where they apply.
| Item | Description |
|---|---|
| Subject matter | Provision of the RYPT athlete development platform (web, mobile apps, APIs and support) to Customer for coaching, programming, workload management, performance profiling, wellness monitoring and injury management of its End Users. |
| Duration | The Subscription Term plus the export and deletion periods in clause 12. |
| Nature of processing | Collection via the apps and web platform, storage, organisation, structuring, retrieval, display to authorised Trainers and End Users, analysis and calculation of training metrics, backup, transmission of transactional notifications, export, and deletion. |
| Purpose | To deliver the Services as configured by Customer: delivering programmes to End Users, recording training and wellness data, analysing performance and workload, managing injuries and return-to-play, and enabling communication between Customer’s Trainers and End Users. RYPT does not process Customer Personal Data for its own purposes except as an independent controller under clause 3.2. |
| Categories of data subjects | End Users: athletes and clients of Customer, including minors (typically 13 and over in academy and school settings). Trainers: Customer’s coaches, staff and contractors (as to data Customer submits about them). Parents or guardians where Customer records their consent or contact details. Purchasers of Products sold by Customer’s Trainers, from the point they redeem the Product and are connected to Customer’s Gym until the end of the Access Period; before redemption, RYPT is the controller of their account and transaction data. |
| Categories of personal data | Identity and contact: name, email address, phone number, date of birth, profile image. Athletic: training programmes, exercise logs, session RPE, loads, performance test results, activity data, team and squad membership. Body: height, weight, body composition. Nutrition: meal logs and meal photos. Wellness: sleep, mood, stress, soreness, readiness questionnaires. Communications: messages between Trainers and End Users within the Services. |
| Special categories (Article 9) | Health data: injury records and notes entered by Trainers, rehabilitation and return-to-play status, menstrual cycle data, wellness data to the extent it reveals health status. No genetic, biometric-for-identification, criminal, sexual orientation, religious, political or trade union data is intended to be processed (clause 4.3). |
| Frequency | Continuous for the Subscription Term. |
| Retention | As set out in clause 12 and Customer’s own configuration. |
| Sub-processor processing | Hosting, database, storage, transactional email, crash and performance monitoring, as described in Annex III. Payment processing for Customer billing and Product sales is carried out by Stripe as an independent controller of payment data, not as a Sub-processor. |
Annex II — Technical and organisational measures
This Annex also serves as Annex II of the SCCs where they apply. Every line below is a commitment a customer can audit against under clause 11, so each one must be true on the day of publication; items marked [CONFIRM] are my assumptions about current practice.
| Area | Measures |
|---|---|
| Hosting and physical security | Production systems hosted in Microsoft Azure, West Europe region (Netherlands), in data centres certified to ISO 27001, SOC 2 and related standards. RYPT has no physical access to servers; physical controls are inherited from Microsoft. |
| Encryption | All data encrypted in transit using TLS 1.2 or higher. Data at rest encrypted using AES-256 via Azure-managed encryption for databases, storage and backups. Secrets and keys held in Azure Key Vault. |
| Access control | Production access limited to named engineering staff on a least-privilege basis, reviewed at least quarterly. Multi-factor authentication required for all administrative and cloud-console access. Access revoked within one business day of role change or departure. No standing access to production databases for support staff; access granted per ticket and logged. |
| Application security | Role-based permissions within the Services (Gym owner, Admin, Trainer, Medical Team, End User) enforced server-side. Password policy with minimum length and hashing using an industry-standard algorithm (bcrypt or Argon2). Session management with expiry. Secure development practices including code review before merge, dependency vulnerability scanning and separation of development, staging and production environments. |
| Testing | Independent penetration test of the web platform and APIs at least annually and after major changes [CONFIRM cadence and last date]; findings rated high or critical remediated within 30 days. Automated vulnerability scanning of infrastructure. |
| Logging and monitoring | Application, access and infrastructure logs retained for at least 90 days [CONFIRM]. Alerting on authentication anomalies, privilege changes and infrastructure health. Logs protected from modification. |
| Backup and resilience | Automated daily backups of production databases with point-in-time recovery, encrypted and retained for 90 days. Backups stored within the EEA. Restore procedures tested at least annually. Recovery time objective 24 hours; recovery point objective 24 hours. |
| Data segregation | Logical separation of each Customer’s Gym data through tenant identifiers enforced at the application and query layer. No shared accounts between customers. |
| Pseudonymisation and minimisation | Usage analytics and crash reporting receive pseudonymous identifiers only, never End User health data. Customer and |End Users decide which data categories are collected from End Users. |
| Personnel | All staff and contractors bound by written confidentiality obligations. Data protection and security awareness training at onboarding and annually. Background checks where lawful and proportionate for roles with production access. |
| Incident management | Documented incident response procedure with defined roles, severity classification, containment, customer notification under clause 9, root-cause analysis and post-incident review. |
| Sub-processor management | Due diligence before engagement covering security certifications, data location and transfer mechanism; written data processing terms with each Sub-processor; annual review of the Sub-processor list. |
| Governance | Information security management system aligned with ISO/IEC 27001, with a named security owner, documented policies reviewed annually, and a risk register. Records of processing maintained under Article 30 GDPR. |
| Data subject rights | In-app tools for End Users to view, correct, export and request deletion of their own data, and for Customers to export End User Data, supporting the assistance obligations in clause 10. |
| Deletion | Deletion from production on request or termination, and from backups within the backup retention period, as set out in clause 12. |
Annex III — Sub-processors
The authoritative list is published at [https://www.rypt.app/legal/sub-processors] and governed by clause 6. This Annex records the list as at the date of this DPA. It lists only Sub-processors that process Customer Personal Data on RYPT’s behalf; vendors RYPT uses as an independent controller (accounting, internal communications, project tools, marketing to Customers) appear in the Privacy Policy instead.
| Sub-processor | Service | Data processed | Location of processing | Transfer mechanism |
|---|---|---|---|---|
| Microsoft Ireland Operations Ltd (Azure) | Cloud hosting, database, storage, backup, key management | All Customer Personal Data | EEA (West Europe, Netherlands) | None required; Microsoft is DPF-certified for any support-related access from the US |
| MongoDB, Inc. (Atlas) [CONFIRM region and entity] | Database for coach and athlete invitation records | Name, email address, invite token | EEA [CONFIRM] | None required if EEA-hosted; SCCs with MongoDB otherwise |
| Intuit Inc. (Mailchimp / Mandrill) | Transactional email delivery (invitations, password resets, service notices) to Trainers and End Users | Name, email address, message content | United States | EU-US Data Privacy Framework (Intuit certified) |
| Google LLC (Firebase) [CONFIRM services] | Mobile app crash reporting and performance monitoring | Pseudonymous device and app identifiers, crash logs; no End User health data | United States / EEA | EU-US Data Privacy Framework (Google certified) |
| Microsoft (Application Insights) | Platform usage and performance analytics | Pseudonymous usage identifiers and events | EEA | None required |
| Stripe Payments Europe, Ltd. | Payment processing for Customer subscriptions and Product sales (Stripe Connect) | Customer billing details, Purchaser transaction data and Connect account details. Stripe is an independent controller of payment data under its own terms; listed here for transparency, not as a Sub-processor | EEA (with Stripe, Inc. US affiliates) | Stripe’s intra-group SCCs and DPF certification |
| Google LLC (Google Workspace) | Support email handling where Customer or Users contact support | Name, email address, support correspondence, which may incidentally include End User Data the sender includes | EEA / United States | EU-US Data Privacy Framework (Google certified) |
| HubSpot, Inc. | Customer relationship and support ticketing for Customer accounts | Trainer and Customer contact details only; no End User Data | EEA (EU data hosting) | EU-US Data Privacy Framework (HubSpot certified) for US support access |
RYPT does not use AI model vendors, push-notification vendors beyond Apple and Google’s platform services, or chat vendors to process Customer Personal Data. Apple Push Notification service and Firebase Cloud Messaging carry notification content only.
Annex IV — International transfers
A. EU Standard Contractual Clauses. Where clause 7.3 applies, the parties incorporate the SCCs (Commission Implementing Decision (EU) 2021/914) as follows:
| SCC element | Selection |
|---|---|
| Module | Module Two (controller to processor) where Customer is a controller; Module Three (processor to processor) where Customer is a processor under clause 3.1 |
| Clause 7 (docking) | Not included |
| Clause 9 (sub-processors) | Option 2, general written authorisation, with the notice period in clause 6.2 of this DPA |
| Clause 11 (redress) | Optional language not included |
| Clause 13 | The supervisory authority of the Member State where Customer is established; where Customer is not in the EEA, the Irish Data Protection Commission |
| Clause 17 (governing law) | Option 1, the laws of Ireland |
| Clause 18 (forum) | The courts of Ireland |
| Annex I.A (parties) | Data exporter: Customer, as identified in its account. Data importer: RYPT, as identified in clause 1.1. Contact: [privacy@rypt.app] |
| Annex I.B (processing) | Annex I of this DPA |
| Annex I.C (competent authority) | As per Clause 13 above |
| Annex II (TOMs) | Annex II of this DPA |
| Annex III (sub-processors) | Annex III of this DPA |
B. UK Addendum. Where UK Data Protection Law applies to a transfer, the parties incorporate the UK Addendum (version B1.0, in force 21 March 2022) with the SCCs as completed above, and: Table 1 parties as in Annex I.A; Table 2 the SCCs as selected above; Table 3 Annexes I, II and III of this DPA; Table 4 both parties may end the Addendum as set out in its section 19.
C. Transfer impact. RYPT has assessed the transfers in Annex III. Customer Personal Data at rest remains in the EEA; residual transfers are limited to transactional email, crash reporting and support correspondence, to recipients certified under the EU-US Data Privacy Framework. RYPT will update this assessment if a mechanism is invalidated or a Sub-processor changes, under clause 7.4.
D. Switzerland. Where Swiss data protection law applies, references to the GDPR in the SCCs are read as references to the Swiss Federal Act on Data Protection and the Swiss Federal Data Protection and Information Commissioner is the competent authority.