International Data Transfer Addendum

Last updated: July 9, 2026

This International Data Transfer Addendum ("Transfer Addendum") supplements the Data Processing Agreement and Privacy Policy of TerminalStreet LLC ("TerminalStreet," "we," "us," "our") and provides additional safeguards and mechanisms for lawful cross-border transfers of personal data.

1. Data Transfer Framework

TerminalStreet transfers personal data internationally in accordance with the following principles:

• We only transfer personal data to countries or recipients that can ensure an adequate level of data protection
• Where adequacy is not established, we implement appropriate safeguards as required by applicable laws
• We maintain transparent documentation of all international data transfer mechanisms
• We regularly review and update our transfer mechanisms to reflect evolving regulatory requirements

2. European Union and United Kingdom Transfers

2.1 Legal Basis for EU/UK Transfers

For transfers of personal data from the European Economic Area (EEA), United Kingdom (UK), or Switzerland to countries that have not received an adequacy decision, TerminalStreet relies on one or more of the following legal mechanisms:

• EU Standard Contractual Clauses (SCCs): We implement the European Commission's approved Standard Contractual Clauses (Commission Implementing Decision 2021/914 of June 4, 2021)
• UK International Data Transfer Agreement (IDTA): For UK data subjects, we implement the UK IDTA approved by the UK Information Commissioner's Office or the UK Addendum to the EU SCCs
• Swiss Transborder Data Flow Agreement: For transfers from Switzerland, we implement the appropriate safeguards as required by the Swiss Federal Data Protection Act
• Derogations: In limited specific situations, we may rely on GDPR Article 49 derogations, such as explicit consent, contractual necessity, important public interest, or legal claims

2.2 Supplementary Measures

Following the Court of Justice of the European Union's "Schrems II" decision, we implement supplementary measures to enhance the protections afforded by SCCs where necessary:

• Technical measures: Including end-to-end encryption, pseudonymization, data minimization, and access controls
• Organizational measures: Including transparency reporting, documentation of government access requests, and contractual commitments to challenge disproportionate government access requests
• Legal measures: Including transfer impact assessments, enhanced data subject rights, and additional contractual safeguards

3. Asia-Pacific Region Transfers

3.1 Japan

For transfers of personal data to and from Japan, TerminalStreet complies with the Act on the Protection of Personal Information (APPI) by:

• Obtaining prior consent when required for cross-border transfers
• Implementing appropriate contractual provisions to ensure the protection of personal data
• Adhering to the supplementary rules for the handling of personal data transferred from the EU under the EU-Japan adequacy decision

3.2 China

For transfers involving personal data from China, TerminalStreet complies with the Personal Information Protection Law (PIPL) by:

• Conducting security assessments where required by the Cyberspace Administration of China (CAC)
• Obtaining certification from specialized institutions for personal information protection
• Entering into contracts based on standard contract templates provided by the CAC
• Obtaining separate informed consent from individuals when transferring personal information outside of China

3.3 Singapore

For transfers involving personal data from Singapore, TerminalStreet complies with the Personal Data Protection Act (PDPA) by:

• Ensuring the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to the PDPA
• Implementing appropriate contractual clauses to ensure adequate protection
• Obtaining consent from individuals where required

3.4 Australia and New Zealand

For transfers involving personal data from Australia and New Zealand, TerminalStreet complies with:

• Australian Privacy Principles (APP): Particularly APP 8, which governs cross-border disclosures of personal information
• New Zealand Privacy Act 2020: Including Information Privacy Principle 12 regarding disclosure of personal information outside New Zealand

Our measures include:

• Contractual safeguards ensuring overseas recipients handle personal information in accordance with the APPs and New Zealand Privacy Act
• Conducting reasonable steps to ensure overseas recipients do not breach the APPs
• Maintaining accountability for personal information transferred overseas

4. Latin America Transfers

4.1 Brazil

For transfers involving personal data from Brazil, TerminalStreet complies with the General Data Protection Law (LGPD) by:

• Implementing standard contractual clauses as approved by the Brazilian Data Protection Authority (ANPD)
• Obtaining specific consent for international transfers where required
• Ensuring that recipient countries or organizations provide an adequate level of data protection
• Conducting data transfer impact assessments

4.2 Other Latin American Countries

For transfers involving personal data from other Latin American countries with comprehensive data protection laws (e.g., Argentina, Colombia, Mexico), TerminalStreet:

• Implements appropriate contractual safeguards in line with local requirements
• Obtains consent where required by local law
• Ensures compliance with any applicable registration or notification requirements

5. Subprocessors and Onward Transfers

When TerminalStreet transfers personal data to third-party service providers (subprocessors), we:

• Ensure they are contractually bound by the same data protection obligations
• Implement appropriate transfer mechanisms as required by applicable laws
• Maintain and update a list of subprocessors as described in our Subprocessors page
• Conduct appropriate due diligence on their data protection practices

For a current list of subprocessors, please see our Subprocessors page.

6. Data Subject Rights

Regardless of where your personal data is transferred, you retain your data subject rights as described in our Privacy Policy. These include rights to:

• Access your personal data
• Correct inaccurate data
• Delete your data in certain circumstances
• Restrict or object to processing
• Data portability
• Withdraw consent
• Lodge a complaint with a supervisory authority

These rights may vary based on your jurisdiction, and certain exemptions may apply. To exercise your rights, please contact us at [email protected].

7. Updates to this Transfer Addendum

We may update this Transfer Addendum from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes as required by applicable law. We encourage you to review this Transfer Addendum periodically.

8. Contact Information

If you have any questions about international data transfers or this Transfer Addendum, please contact us at:

[email protected]