Requirements of International Transfers of Personal Data(Global)
This document is an integral part of applicable Avaya Data Processing Addendum / Agreement / Annex / Attachment (or any other equivalent
document, as applicable), which incorporates it by reference, between Avaya and Supplier (the “DPA”), and sets out how the Supplier shall comply
with requirements of international transfers of Personal Data. The content below will be updated by Avaya from time to time to the extent requiredby the applicable law.

1.

International transfers of Personal Data
1.1. Supplier shall comply with applicable data privacy law regarding international transfers of Personal Data.

2.

Transfers of personal data originating from the European Economic Area (“EEA”)
2.1. If Avaya transfers Personal Data originating from the EEA to Supplier located in countries outside the EEA that have not received abinding adequacy decision by the competent body (such a country being a “Third Country”), such transfers shall be subject to (i)the terms of the appropriate Standard Contractual Clauses, as specified in (a) and (b) below (the “EU Model Clauses”); or (ii) otherappropriate transfer mechanisms that provide an adequate level of protection in compliance with applicable data protection law.
(a)

Processor to Sub-Processor EU Model Clauses (applicable if Avaya acts as Data Processor – see Data Processing
Form attached to the DPA).

(b)Controller to Processor EU Model Clauses (applicable if Avaya acts as Data Controller – see Data Processing Form
attached to the DPA).

2.2. If Supplier transfers Personal Data originating from the EEA to any third-party Data Sub-Processors (including its Affiliates) locatedin countries outside the EEA that have not received a binding adequacy decision by the competent body, such transfers shall be
subject to (i) the EU Model Clauses; or (ii) other appropriate transfer mechanisms that provide an adequate level of protection incompliance with applicable data protection law.
2.3. In this context Supplier agrees that the EU Model Clauses shall also apply with respect to Personal Data of customers of Avaya, tothe extent that such customers are deemed to be Data Controllers of the Personal Data processed by Supplier and such Personal
Data is being processed by Supplier (“Customer Controllers”). The Supplier shall agree a third-party beneficiary clause with theData Sub-Processor whereby – in the event the Supplier has factually disappeared, ceased to exist in law or has become insolvent– Avaya shall have the right to terminate the Data Sub-Processor contract and to instruct the Data Sub-Processor to erase or return
the Personal Data.

3.

Transfers of personal data originating from Switzerland (“Swiss”)
3.1. If Avaya transfers Personal Data originating from Switzerland to Supplier located in countries outside Switzerland that have notreceived a binding adequacy decision by the competent body (such a country being a “Third Country”), such transfers shall besubject to (i) the terms of the appropriate Standard Contractual Clauses, as specified in (a) and (b) below (the “Swiss ModelClauses”); or (ii) other appropriate transfer mechanisms that provide an adequate level of protection in compliance with applicabledata protection law.
(a)

Processor to Sub-Processor EU Model Clauses supplemented by the Swiss Supplementary Terms (applicable if
Avaya acts as Data Processor – see Data Processing Form attached to the DPA).

(b)Controller to Processor EU Model Clauses supplemented by the Swiss Supplementary Terms (applicable if Avaya
acts as Data Controller – see Data Processing Form attached to the DPA).

3.2. If Supplier transfers Personal Data originating from Switzerland to any third-party Data Sub-Processors (including its Affiliates)
located in countries outside Switzerland that have not received a binding adequacy decision by the competent body, such transfers
shall be subject to (i) the Swiss Model Clauses; or (ii) other appropriate transfer mechanisms that provide an adequate level ofprotection in compliance with applicable data protection law.
3.3. In this context Supplier agrees that the Swiss Model Clauses shall also apply with respect to Personal Data of customers of Avaya,
to the extent that such customers are deemed to be Data Controllers of the Personal Data processed by Supplier and such Personal
Data is being processed by Supplier (“Customer Controllers”). The Supplier shall agree a third-party beneficiary clause with theData Sub-Processor whereby – in the event the Supplier has factually disappeared, ceased to exist in law or has become insolvent– Avaya shall have the right to terminate the Data Sub-Processor contract and to instruct the Data Sub-Processor to erase or return
the Personal Data.
Requirements of International Transfers of Personal Data

Page 1 of 2

Version 12/23

4.

Transfers of personal data originating from the United Kingdom (“UK”)
4.1. If Avaya transfers Personal Data originating from the UK to Supplier located in countries outside the UK that have not received abinding adequacy decision by the competent body (such a country being a “Third Country”), such transfers shall be subject to (i)the terms of the appropriate EU Standard Contractual Clauses supplemented by the UK International Data Transfer Addendum, asspecified below (the “UK Model Clauses”); or (ii) other appropriate transfer mechanisms that provide an adequate level of protection
in compliance with applicable data protection law.
a)

Processor to Sub-Processor EU Model Clauses supplemented by the UK International Data Transfer Addendum(applicable if Avaya acts as Data Processor – see Data Processing Form attached to the DPA).

b)Controller to Processor EU Model Clauses supplemented by the UK International Data Transfer Addendum(applicable if Avaya acts as Data Controller – see Data Processing Form attached to the DPA).

4.2. If Supplier transfers Personal Data originating from the UK to any third-party Data Sub-Processors (including its Affiliates) located incountries outside the UK that have not received a binding adequacy decision by the competent body, such transfers shall be subject
to (i) the UK Model Clauses; or (ii) other appropriate transfer mechanisms that provide an adequate level of protection in compliancewith applicable data protection law.
4.3. In this context Supplier agrees that the UK Model Clauses shall also apply with respect to Personal Data of customers of Avaya, tothe extent that such customers are deemed to be Data Controllers of the Personal Data processed by Supplier and such Personal
Data is being processed by Supplier (“Customer Controllers”). To the fullest extent permitted by applicable law, Customer
Controllers shall be entitled to assert against Supplier rights and remedies under the UK Model Clauses as a third-party beneficiary
hereto, with respect to those provisions of the UK Model Clauses affording a right, benefit or privilege to the Customer Controllers.
5.

Transfers of personal data originating from China

5.1.

If Avaya transfers Personal Data originating from the China to Supplier located in countries outside China, the Supplier will comply(as Avaya’s sub-processor) with the terms of the Chinese Standard Contractual Clauses.

Requirements of International Transfers of Personal Data

Page 2 of 2Version 12/23