Data Transfer Impact Assessment
This document is designed to provide information to assist Jamf customers with
conducting data transfer impact assessments in connection with their use of Jamf
products, considering the Schrems II ruling of the Court of Justice of the European Unionand the European Data Protection Board’s related recommendations.
This document describes the legal regimes applicable to Jamf in the United States(“US”), the safeguards Jamf puts in place in connection with transfers of customer
personal data from the European Economic Area (“EEA”), United Kingdom (“UK”) or
Switzerland, and Jamf’s ability to comply with its obligations as “data importer” under
the relevant personal data transfer mechanisms – the EEA Standard Contractual Clauses(“EEA SCCs”),UK Addendum, or the EEA SCCs subject to modifications andamendments prescribed by the Swiss Federal Data Protection and Information
Commissioner (“Swiss SCCs”).
Jamf safeguards the personal data our customers entrust us to process, particularly
when circumstances require that we transfer that personal data to a third country lacking
an adequacy decision — whether for the purposes of support, Hosted Services, or
security review.
Where the customer is the controller of the data, Jamf may transfer customer’s personal
data outside of the customer’s primary region to provide our services. For example, Jamf
provides support and hosted services with staff from various countries around the world.
Jamf employees may need to access personal data to provide these services. In a few
circumstances, we may utilize vendors (as sub-processors to Jamf) outside ourcustomers’ primary regions.
The transfer impact assessment information below identifies and describes the risks
associated with data transfers of personal data to third countries lacking an adequacy
decision, as well as any supplementary measures we have taken — or have required ourvendors to take — to safeguard personal data. Please see our Data Processing
Agreement for Jamf Customers (“DPA”) for additional details, such as the nature of theprocessing or the retention period of the data. In all cases, the categories of data
subjects are the employees of Jamf customers (or students of Jamf customers if thecustomer is an education customer). For additional resources about Jamf’s Software
License and Service Agreement, DPA, and Privacy program, please visit Jamf’s TrustCenter. Our list of sub-processors is available in the Trust Center.

Transfer Impact Assessment
Jamf’s DPA incorporates the EEA SCCs, UK Addendum, and Swiss SCCs. In responseto the heightened requirements created by the Schrems II decision, the European
Commission adopted the EEA SCCs, which require a data importer (Jamf in this case)to provide specific information about personal data transfers it undertakes, and requires

the parties to conduct a transfer impact assessment to evaluate risks involved with thetransfer of personal data to countries outside the EEA. The EEA SCCs also require theparties to take into account any relevant contractual, technical, and organizationalsafeguards to supplement the safeguards set forth in the EEA SCCs.
Please refer to Schedule 1 of the DPA for a description of personal data transfers,
including the nature of Jamf’s processing activities in connection with the provision of
the services, the types of customer personal data transferred, and the categories of data
subjects.
Please refer to Schedule 3 of the DPA to review the security measures Jamf has
implemented to protect the personal data of our customers’ data subjects.

Transfer of data to the US
In response to Schrems II, the European Data Protection Board (EDPB) has made clearthat Binding Corporate Rules and approved standard contractual clauses remain valid
data transfer mechanisms. As the EDPB states in its guidance, however, transfer
mechanisms do not operate in a vacuum, and may need to be paired with supplementarymeasures that enhance protection of personal data.
Jamf relies on our DPA as the transfer mechanism used to transfer personal data outside
the EEA, UK and/or Switzerland. Jamf’s DPA incorporates the EEA SCCs, UK
Addendum, and Swiss SCCs. In addition, Jamf is certified as a participant in the EUU.S. and Swiss-U.S. Data Privacy Frameworks, as well as the UK Extension to the EUU.S. Data Privacy Framework. You can confirm Jamf’s participation here: Data Privacy
Framework Participant Search.

EU data storage
Most Jamf products have the option for customers to choose where their data is stored,
including an option in the EEA. However, Jamf may need to process this data in othercountries to support our customers, to provide our hosted services, and conduct
security incident reviews.
Certain Jamf products do not allow for regional data hosting. For Jamf Now, all data ishosted in the US. In the case of Jamf Data Policy, Jamf Private Access and Jamf Threat
Defense, data is only hosted in Ireland. Jamf Protect and Jamf Connect allow for regional
data hosted with the exception of certain functionality, in which case data is hosted in
Ireland.
Please refer to Jamf’s Sub-processors documentation to better understand where yourdata may be stored for each product or service you subscribe to.

US Surveillance Laws
Is Jamf subject to FISA 702, EO 12333 or the CLOUD Act?
Jamf, like most US-based SaaS companies, could technically be subject to FISA 702
where it is deemed to be a remote computing service provider (“RCSP”). However, Jamf
does not process personal data that is likely to be of interest to US intelligence agencies.
Furthermore, Jamf is not likely to be subject to upstream surveillance orders under FISA
702, the type of order principally addressed in, and deemed problematic by, the Schrems
II decision. Jamf does not provide internet backbone services, but instead only carries
traffic involving its own customers. To date, the US Government has interpreted andapplied FISA 702 upstream orders to only target market providers that have traffic
flowing through their internet backbone and that carry traffic for third parties (i.e.,
telecommunications carriers).
EO 12333 contains no authorization to compel private companies (such as Jamf) todisclose personal data to US authorities and FISA 702 requires an independent court toauthorize a specific type of foreign intelligence data acquisition which is generally
unrelated to commercial information. If US intelligence agencies were interested in thetype of data that Jamf processes, safeguards such as the requirement for authorization
by an independent court and the necessity and proportionality requirements would
protect data from excessive surveillance.
Where Jamf is deemed to be a RCSP, the CLOUD Act could apply to Jamf. However,
we don’t believe the type of data processed on behalf of Jamf customers would be ofinterest to the U.S. Government or law enforcement authorities. The CLOUD Act does
not make data easily accessible to the U.S. Government. It operates, in part to amend
the Electronic Communications Privacy Act, which is a law that prescribes how law
enforcement agencies may obtain information from technology companies. These laws
address access to electronic data in relation to government efforts to protect public
safety and combat serious crime, as well as to address conflicting laws between the U.S.
and other countries by creating a framework for the U.S. Government to resolve conflicts
and mutually agree to respect law and privacy.
Under the CLOUD Act, electronic content can only be requested from providers with awarrant that must identify the data being sought. The warrant must be approved by acourt, and if approved, the CLOUD Act allows providers, like Jamf, to challenge the court
order, particularly if there are conflicts with a foreign country’s laws. Jamf will takereasonably necessary actions if served with a warrant related to a CLOUD Act data
request to protect data in its possession, including ensuring compliance with Section 4g) of Jamf’s DPA. The CLOUD Act does not allow the U.S. Government to collect bulk
data – the data requested must be specific and the warrant needs to be based on
probable cause for a crime.

What is Jamf’s experience dealing with government access requests?
To date, Jamf has never received a US National Security Request (including requests
for access under FISA 702 or the CLOUD Act or direct access under EO 12333) inconnection with customer personal data.
Therefore, while Jamf may technically be subject to the surveillance laws identified in
Schrems II we have not been subject to these types of requests in our day-to-day
business operations.

Jamf Services’ Processing Locations
Jamf provides hosting locations that may differ between products and features withincertain products. Please review the locations of data hosting for the products andservices you subscribe to in our Sub-processors documentation.

Onward transfers
Australia
Internal transfer: Jamf has an office inAustralia, and employees there may needto process the customer’s personal data
for the purposes of support or hosting
services.

Purpose for transfer and any further
processing

Transfer to sub-processor: Jamf Pro
and Protect uses AWS to store data inAustralia.
Jamf uses AWS for our edge services toprocess data in Australia as part of Jamf
Data Policy, Private Access, Threat
Defense, and Safe Internet. Jamf
Connect and Protect include featuresthat may also use these edge services.
Data related to these products andfeatures is then transferred to Ireland or
the United States (hosting option forJamf Safe Internet only) for storage andfurther processing.
Please see our list of sub-processors for
specific information.
Internal transfer: Data is transferred asneeded to provide support and hosting
services.
The frequency of the transfer

Categories of personal data transferred
Sensitive data transferred

Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Transfer to sub-processor: Data istransferred continuously to AWS for
customers in this region for hosting andedge services.
See Section B of Schedule 1 to Jamf’s
DPA.
None
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers.
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.

Supplemental Organizational, Technical,
and Contractual Security Measures

Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to itscustomers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.

Jamf Policy for Law Enforcement
Requests to Client Data

Internal Transfer: Jamf’s DPA compels
us to notify our customer of requests
unless explicitly prohibited from doing so
by law. Please note that Jamf does notand cannot conduct real-time
surveillance of customers. To date, Jamf
has not received a request from law
enforcement for client data.
Transfer to sub-processor: Jamf
ensures that the data processing
agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.
Internal transfer: Data is transferredinternally within Jamf.

Length of processing chain

Transfer to sub-processor: Data istransferred externally to our subprocessors.
Internal transfer: EEA SCCs, UK
Addendum, and/or Swiss SCCs (asapplicable), which are incorporated into
Jamf’s DPA.

Applicable transfer mechanism

Transfer to sub-processor: EEA SCCs,
UK Addendum, and/or Swiss SCCs (asapplicable) for onward transfers to our
sub-processors.

Belgium
Purpose for transfer and any further
processing

Transfer to sub-processor: Jamf uses
Google Cloud Platform for our edge

services to process data in Belgium aspart of Jamf Data Policy, Threat Defense,and Safe Internet. Jamf Protect includes
features that may also use these edge
services. Data related to these products
and features is then transferred to Irelandor the United States (hosting option for
Jamf Safe Internet only) for storage andfurther processing.
Please see our list of sub-processors for
specific information.

The frequency of the transfer

Categories of personal data transferred
Sensitive data transferred

Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Supplemental Organizational, Technical,
and Contractual Security Measures

Jamf Policy for Law Enforcement
Requests to Client Data

Transfer to sub-processor: Data istransferred continuously to Google Cloud
Platform for customers in this region for
their edge services.
See Section B of Schedule 1 to Jamf’s
DPA.
None
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers.
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.
Transfer to sub-processor: Jamf
ensures that the data processing

agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.

Length of processing chain

Applicable transfer mechanism

Transfer to sub-processor: Data istransferred externally to our subprocessors.
Transfer to sub-processor: EEA SCCs,
UK Addendum, and/or Swiss SCCs (asapplicable) for onward transfers to our
sub-processors.

BrazilPurpose for transfer and any further
processing

Transfer to sub-processor: Jamf uses
AWS for our edge services to processdata in Brazil as part of Jamf Data Policy,
Private Access, Threat Defense, and Safe
Internet. Jamf Connect and Protect
include features that may also use theseedge services. Data related to theseproducts and features is then transferred
to Ireland or the United States (hosting
option for Jamf Safe Internet only) for
storage and further processing.
Please see our list of sub-processors for
specific information.

The frequency of the transfer

Categories of personal data transferred
Sensitive data transferred

Transfer to sub-processor: Data istransferred continuously to AWS for
customers in this region for their edge
services.
See Section B of Schedule 1 to Jamf’s
DPA.
None

Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Supplemental Organizational, Technical,
and Contractual Security Measures

Jamf Policy for Law Enforcement
Requests to Client Data

Length of processing chain

Applicable transfer mechanism

Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers.
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.
Transfer to sub-processor: Jamf
ensures that the data processing
agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.
Transfer to sub-processor: Data istransferred externally to our subprocessors.
Transfer to sub-processor: EEA SCCs,
UK Addendum, and/or Swiss SCCs (asapplicable) for onward transfers to our
sub-processors.

CanadaPurpose for transfer and any further
processing

Transfer to sub-processor: Jamf uses
AWS for our edge services to processdata in Canada as part of Jamf Data
Policy, Private Access, Threat Defense,and Safe Internet. Jamf Connect andProtect include features that may also
use these edge services. Data related tothese products and features is thentransferred to Ireland or the United States(hosting option for Jamf Safe Internet
only) for storage and further processing.
Please see our list of sub-processors for
specific information.

The frequency of the transfer

Categories of personal data transferred
Sensitive data transferred

Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Supplemental Organizational, Technical,
and Contractual Security Measures

Jamf Policy for Law Enforcement
Requests to Client Data

Transfer to sub-processor: Data istransferred continuously to AWS for
customers in this region for their edge
services.
See Section B of Schedule 1 to Jamf’s
DPA.
None
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers.
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.
Transfer to sub-processor: Jamf
ensures that the data processing
agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.

Length of processing chain

Applicable transfer mechanism

Transfer to sub-processor: Data istransferred externally to our subprocessors.
Transfer to sub-processor: EEA SCCs,
UK Addendum, and/or Swiss SCCs (asapplicable) for onward transfers to our
sub-processors.

Czechia

Purpose for transfer and any further
processing

The frequency of the transfer

Categories of personal data transferred
Sensitive data transferred
Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Supplemental Organizational, Technical,
and Contractual Security Measures

Jamf Policy for Law Enforcement
Requests to Client Data

Internal transfer: Jamf has an office inCzechia, and employees there may needto process the customer’s personal data
for the purposes of security operations.
Internal transfer: Data is transferred asneeded for security operations.
See Section B of Schedule 1 to Jamf’s
DPA.
None
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.
Internal Transfer: Jamf’s DPA compels
us to notify our customer of requests
unless explicitly prohibited from doing so
by law. Please note that Jamf does notand cannot conduct real-time
surveillance of customers. To date, Jamf
has not received a request from law
enforcement for client data.

Length of processing chain

Applicable transfer mechanism

Internal transfer: Data is transferredinternally within Jamf.
Internal transfer: EEA SCCs, UK
Addendum, and/or Swiss SCCs (asapplicable), which are incorporated into
Jamf’s DPA.

FranceInternal transfer: Jamf has an office inFrance, and employees there may needto process the customer’s personal data
for the purposes of support.

Purpose for transfer and any further
processing

Transfer to sub-processor: Jamf uses
AWS for our edge services to processdata in France as part of Jamf Data
Policy, Threat Defense, and Safe Internet.
Jamf Protect includes features that may
also use these edge services. Data
related to these products and features isthen transferred to Ireland or the UnitedStates (hosting option for Jamf Safe
Internet only) for storage and further
processing.
Please see our list of sub-processors for
specific information.
Internal transfer: Data is transferred asneeded to provide support.

The frequency of the transfer

Transfer to sub-processor: Data istransferred continuously to AWS for
customers in this region for their edge

services.
Categories of personal data transferred
Sensitive data transferred

Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

See Section B of Schedule 1 to Jamf’s
DPA.
None
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers.
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.

Supplemental Organizational, Technical,
and Contractual Security Measures

Jamf Policy for Law Enforcement
Requests to Client Data

Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.
Internal Transfer: Jamf’s DPA compels
us to notify our customer of requests
unless explicitly prohibited from doing so
by law. Please note that Jamf does notand cannot conduct real-time
surveillance of customers. To date, Jamf

has not received a request from law
enforcement for client data.
Transfer to sub-processor: Jamf
ensures that the data processing
agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.
Internal transfer: Data is transferredinternally within Jamf.
Length of processing chain

Transfer to sub-processor: Data istransferred externally to our subprocessors.
Internal transfer: EEA SCCs, UK
Addendum, and/or Swiss SCCs (asapplicable), which are incorporated into
Jamf’s DPA.

Applicable transfer mechanism

Transfer to sub-processor: EEA SCCs,
UK Addendum, and/or Swiss SCCs (asapplicable) for onward transfers to our
sub-processors.

Germany
Internal transfer: Jamf has an office inGermany, and employees there mayneed to process the customer’s personal
data for the purposes of support.
Purpose for transfer and any further
processing

Transfer to sub-processor: Jamf Pro,
Protect, and School uses AWS to store
data in Germany.
Jamf uses AWS for our edge services toprocess data in Germany as part of Jamf
Data Policy, Private Access, Threat
Defense, and Safe Internet. Jamf
Connect and Protect include features

that may also use these edge services.
Data related to these products andfeatures is then transferred to Ireland or
the United States (hosting option for
Jamf Safe Internet only) for storage andfurther processing.
Jamf uses Deutsche Telekom for ouredge services to process data in
Germany as part of Jamf Data Policy andThreat Defense for Deutsche Telekom
customers only. Jamf Protect includes
features that may also use these edge
services for Deutsche Telekom
customers only. Data for these products
and features is then transferred to Ireland
for storage and further processing.
Please see our list of sub-processors for
specific information.
Internal transfer: Data is transferred asneeded to provide support.

The frequency of the transfer

Transfer to sub-processor: Data istransferred continuously to AWS for
customers in this region for hosting andedge services.
Data is transferred continuously to
Deutsche Telekom for Deutsche Telekom
customers in this region for edge
services.

Categories of personal data transferred
Sensitive data transferred
Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

See Section B of Schedule 1 to Jamf’s
DPA.
None
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.
Transfer to sub-processor: Jamf enters
into appropriate data processing

agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers.
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.

Supplemental Organizational, Technical,
and Contractual Security Measures

Jamf Policy for Law Enforcement
Requests to Client Data

Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.
Internal Transfer: Jamf’s DPA compels
us to notify our customer of requests
unless explicitly prohibited from doing so
by law. Please note that Jamf does notand cannot conduct real-time
surveillance of customers. To date, Jamf
has not received a request from law
enforcement for client data.
Transfer to sub-processor: Jamf
ensures that the data processing
agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.
Internal transfer: Data is transferredinternally within Jamf.

Length of processing chain
Transfer to sub-processor: Data istransferred externally to our sub-

processors.
Internal transfer: EEA SCCs, UK
Addendum, and/or Swiss SCCs (asapplicable), which are incorporated into
Jamf’s DPA.
Applicable transfer mechanism

Transfer to sub-processor: EEA SCCs,
UK Addendum, and/or Swiss SCCs (asapplicable) for onward transfers to our
sub-processors.

Hong Kong

Purpose for transfer and any further
processing

Transfer to sub-processor: Jamf uses
AWS for our edge services to processdata in Hong Kong as part of Jamf Data
Policy, Threat Defense, Private Access,and Safe Internet. Jamf Connect andProtect include features that may also
use these edge services. Data related tothese products and features is thentransferred to Ireland or the United States(hosting option for Jamf Safe Internet
only) for storage and further processing.
Please see our list of sub-processors for
specific information.

The frequency of the transfer

Categories of personal data transferred
Sensitive data transferred
Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Transfer to sub-processor: Data istransferred continuously to AWS for
customers in this region for their edge
service.
See Section B of Schedule 1 to Jamf’s
DPA.
None
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection ofpersonal data that Jamf offers to its
customers.

Supplemental Organizational, Technical,
and Contractual Security Measures

Jamf Policy for Law Enforcement
Requests to Client Data

Length of processing chain

Applicable transfer mechanism

Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.
Transfer to sub-processor: Jamf
ensures that the data processing
agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.
Transfer to sub-processor: Data istransferred externally to our subprocessors.
Transfer to sub-processor: EEA SCCs,
UK Addendum, and/or Swiss SCCs (asapplicable) for onward transfers to our
sub-processors.

India
Internal transfer: Jamf has an office inIndia, and employees there may need toprocess the customer’s personal data forthe purpose of support.
Purpose for transfer and any further
processing

Transfer to sub-processor: Jamf uses
AWS for our edge services to processdata in India as part of Jamf Data Policy,
Private Access, Threat Defense, and Safe
Internet. Jamf Connect and Protect

include features that may also use theseedge services. Data related to theseproducts and features is then transferred
to Ireland or the United States (hosting
option for Jamf Safe Internet only) for
storage and further processing.
Please see our list of sub-processors for
specific information.
Internal transfer: Data is transferred toprovide support.
The frequency of the transfer

Categories of personal data transferred

Transfer to sub-processor: Data istransferred continuously to AWS for
customers in this region for their edge
service.
See Section B of Schedule 1 to Jamf’s
DPA.

Sensitive data transferred

NoneInternal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.

Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers.

Supplemental Organizational, Technical,
and Contractual Security Measures

Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations that

offer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.

Jamf Policy for Law Enforcement
Requests to Client Data

Internal Transfer: Jamf’s DPA compels
us to notify our customer of requests
unless explicitly prohibited from doing so
by law. Please note that Jamf does notand cannot conduct real-time
surveillance of customers. To date, Jamf
has not received a request from law
enforcement for client data.
Transfer to sub-processor: Jamf
ensures that the data processing
agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.
Internal transfer: Data is transferredinternally within Jamf.

Length of processing chain

Transfer to sub-processor: Data istransferred externally to our subprocessors.
Internal transfer: EEA SCCs, UK
Addendum, and/or Swiss SCCs (asapplicable), which are incorporated into
Jamf’s DPA.

Applicable transfer mechanism

Transfer to sub-processor: EEA SCCs,
UK Addendum, and/or Swiss SCCs (asapplicable) for onward transfers to our
sub-processors.

IrelandTransfer to sub-processor: Jamf Data
Policy, Private Access, Threat Defense,and Safe Internet utilize AWS for data
storage in Ireland. Select features within
Jamf Connect and Protect may also
store data in Ireland.

Purpose for transfer and any further
processing

Jamf utilizes AWS for our edge services
to process data in Ireland as part of Jamf
Data Policy, Private Access, Threat
Defense, and Safe Internet. Selectfeatures within Jamf Connect and Protect
may also process data as part of ouredge services in Ireland, and may betransferred to the United States for
hosting and further processing if chosen
by the customer for Jamf Safe Internet
only.
Please see our list of sub-processors for
specific information.

The frequency of the transfer

Categories of personal data transferred
Sensitive data transferred

Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Supplemental Organizational, Technical,
and Contractual Security Measures

Transfer to sub-processor: Data istransferred continuously to AWS for
customers in this region for their edge
services.
See Section B of Schedule 1 to Jamf’s
DPA.
None
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers.
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors thatinclude data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.

Jamf Policy for Law Enforcement
Requests to Client Data

Length of processing chain

Applicable transfer mechanism

Transfer to sub-processor: Jamf
ensures that the data processing
agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.
Transfer to sub-processor: Data istransferred externally to our subprocessors.
Transfer to sub-processor: EEA SCCs,
UK Addendum, and/or Swiss SCCs (asapplicable) for onward transfers to our
sub-processors.

IsraelPurpose for transfer and any further
processing

The frequency of the transfer

Categories of personal data transferred
Sensitive data transferredInternal transfer: Jamf has an office inIsrael, and employees there may need toprocess customer’s personal data for the
purposes of support.
Internal transfer: Data is transferred asneeded for support.
See Section B of Schedule 1 to Jamf’s
DPA.
None

Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Supplemental Organizational, Technical,
and Contractual Security Measures

Jamf Policy for Law Enforcement
Requests to Client Data

Length of processing chain

Applicable transfer mechanism

Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.
Internal Transfer: Jamf’s DPA compels
us to notify our customer of requests
unless explicitly prohibited from doing so
by law. Please note that Jamf does notand cannot conduct real-time
surveillance of customers. To date, Jamf
has not received a request from law
enforcement for client data.
Internal transfer: Data is transferredinternally within Jamf.
Internal transfer: EEA SCCs, UK
Addendum, and/or Swiss SCCs (asapplicable), which are incorporated into
Jamf’s DPA.

Italy

Purpose for transfer and any further
processing

Transfer to sub-processor: Jamf uses
AWS for our edge services to processdata in Italy as part of Jamf Data Policy,
Threat Defense, and Safe Internet. Jamf
Protect includes features that may also
use these edge services. Data related tothese products and features is thentransferred to Ireland or the United States

(hosting option for Jamf Safe Internet
only) for storage and further processing.
Please see our list of sub-processors for
specific information.

The frequency of the transfer

Categories of personal data transferred
Sensitive data transferred

Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Supplemental Organizational, Technical,
and Contractual Security Measures

Jamf Policy for Law Enforcement
Requests to Client Data

Length of processing chain

Transfer to sub-processor: Data istransferred continuously to AWS for
customers in this region for their edge
services.
See Section B of Schedule 1 to Jamf’s
DPA.
None
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers.
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.
Transfer to sub-processor: Jamf
ensures that the data processing
agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.
Transfer to sub-processor: Data istransferred externally to our sub-

processors.

Applicable transfer mechanism

Transfer to sub-processor: EEA SCCs,
UK Addendum, and/or Swiss SCCs (asapplicable) for onward transfers to our
sub-processors.

Japan
Internal transfer: Jamf has an office inJapan, and employees there may need toprocess customer personal data for the
purposes of support or cloud hosting.
Transfer to sub-processor: Jamf Pro,
Protect, and School each use AWS tostore data in Japan.

Purpose for transfer and any further
processing

Jamf uses AWS for our edge services toprocess data in Japan as part of Jamf
Data Policy, Private Access, Threat
Defense, and Safe Internet. Jamf
Connect and Protect include featuresthat may also use these edge services.
Data related to these products andfeatures is then transferred to Ireland or
the United States (hosting option for
Jamf Safe Internet only) for storage andfurther processing.
Please see our list of sub-processors for
specific information.
Internal transfer: Data is transferred asneeded to provide support and hosting
services.

The frequency of the transfer

Transfer to sub-processor: Data istransferred continuously to AWS for
customers in this region for hosting andedge services.

Categories of personal data transferred

See Section B of Schedule 1 of Jamf’s
DPA.

Sensitive data transferred

NoneInternal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.

Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers.
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.

Supplemental Organizational, Technical,
and Contractual Security Measures

Jamf Policy for Law Enforcement
Requests to Client Data

Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.
Internal Transfer: Jamf’s DPA compels
us to notify our customer of requests
unless explicitly prohibited from doing so
by law. Please note that Jamf does notand cannot conduct real-time
surveillance of customers. To date, Jamf
has not received a request from law
enforcement for client data.
Transfer to sub-processor: Jamf
ensures that the data processing

agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.
Internal transfer: Data is transferredinternally within Jamf.
Length of processing chain

Transfer to sub-processor: Data istransferred externally to our subprocessor.
Internal transfer: EEA SCCs, UK
Addendum, and/or Swiss SCCs (asapplicable), which are incorporated into
Jamf’s DPA.

Applicable transfer mechanism

Transfer to sub-processor: EEA SCCs,
UK Addendum, and/or Swiss SCCs (asapplicable) for onward transfers to our
sub-processors.

Netherlands
Internal transfer: Jamf has an office in
the Netherlands, and employees there
may need to process customer personal
data for the purposes of support or cloud
hosting.

Purpose for transfer and any further
processing

Transfer to sub-processor: Jamf uses
Google Cloud Platform for our edge
services to process data in the
Netherlands as part of Jamf Data Policy,
Threat Defense, and Safe Internet. Jamf
Protect includes features that may also
use these edge services. Data related tothese products and features is thentransferred to Ireland or the United States(hosting option for Jamf Safe Internet
only) for storage and further processing.

Please see our list of sub-processors for
specific information.
Internal transfer: Data is transferred asneeded to provide support and hosting
services.
The frequency of the transfer

Categories of personal data transferred
Sensitive data transferred

Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Transfer to sub-processor: Data istransferred continuously to Google Cloud
Platform for customers in this region for
their edge services.
See Section B of Schedule 1 to Jamf’s
DPA.
None
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers.
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.

Supplemental Organizational, Technical,
and Contractual Security Measures

Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.

Jamf Policy for Law Enforcement
Requests to Client Data

Internal Transfer: Jamf’s DPA compels
us to notify our customer of requests
unless explicitly prohibited from doing so
by law. Please note that Jamf does notand cannot conduct real-time
surveillance of customers. To date, Jamf
has not received a request from law
enforcement for client data.
Transfer to sub-processor: Jamf
ensures that the data processing
agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.
Internal transfer: Data is transferredinternally within Jamf.

Length of processing chain

Transfer to sub-processor: Data istransferred externally to our subprocessors.
Internal transfer: EEA SCCs, UK
Addendum, and/or Swiss SCCs (asapplicable), which are incorporated into
Jamf’s DPA.

Applicable transfer mechanism

Transfer to sub-processor: EEA SCCs,
UK Addendum, and/or Swiss SCCs (asapplicable) for onward transfers to our
sub-processors.

NorwayPurpose for transfer and any further
processing

Transfer to sub-processor: Jamf uses
Microsoft Azure for our edge services toprocess data in Norway as part of Jamf
Data Policy, Threat Defense, and Safe
Internet. Jamf Protect includes features

that may also use these edge services.
Data related to these products andfeatures is then transferred to Ireland or
the United States (hosting option for
Jamf Safe Internet only) for storage andfurther processing.
Please see our list of sub-processors for
specific information.

The frequency of the transfer

Categories of personal data transferred
Sensitive data transferred

Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Supplemental Organizational, Technical,
and Contractual Security Measures

Jamf Policy for Law Enforcement
Requests to Client Data

Transfer to sub-processor: Data istransferred continuously to Microsoft
Azure for customers in this region for
their edge services.
See Section B of Schedule 1 to Jamf’s
DPA.
None
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers.
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.
Transfer to sub-processor: Jamf
ensures that the data processing
agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.

Length of processing chain

Applicable transfer mechanism

Transfer to sub-processor: Data istransferred externally to our subprocessors.
Transfer to sub-processor: EEA SCCs,
UK Addendum, and/or the Swiss SCCs
(as applicable) for onward transfers toour sub-processors.

PolandPurpose for transfer and any further
processing

Internal transfer: Jamf has an office in
Poland, and employees there may needto process the customer’s personal data
for the purposes of support, security
operations, or hosting services.

The frequency of the transfer

Internal transfer: Data is transferred asneeded for security support, security
operations, or hosting services.

Categories of personal data transferred

See Section B of Schedule 1 to Jamf’s
DPA.

Sensitive data transferred
Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

None
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.

Supplemental Organizational, Technical,
and Contractual Security Measures

Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.

Jamf Policy for Law Enforcement
Requests to Client Data

Internal Transfer: Jamf’s DPA compels
us to notify our customer of requests

unless explicitly prohibited from doing so
by law. Please note that Jamf does notand cannot conduct real-time
surveillance of customers. To date, Jamf
has not received a request from law
enforcement for client data.

Length of processing chain

Applicable transfer mechanism

Internal transfer: Data is transferredinternally within Jamf.
Internal transfer: EEA SCCs, UK
Addendum, and/or Swiss SCCs (asapplicable), which are incorporated into
Jamf’s DPA.

Singapore

Purpose for transfer and any further
processing

Transfer to sub-processor: Jamf uses
AWS for our edge services to processdata in Singapore as part of Jamf Data
Policy, Private Access, Threat Defense,and Safe Internet. Jamf Connect andProtect include features that may also
use these edge services. Data related tothese products and features is thentransferred to Ireland or the United States(hosting option for Jamf Safe Internet
only) for storage and further processing.
Please see our list of sub-processors for
specific information.

The frequency of the transfer

Categories of personal data transferred

Transfer to sub-processor: Data istransferred continuously to AWS for
customers in this region for their edge
services.
See Section B of Schedule 1 to Jamf’s
DPA.

Sensitive data transferred

Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Supplemental Organizational, Technical,
and Contractual Security Measures

Jamf Policy for Law Enforcement
Requests to Client Data

Length of processing chain

Applicable transfer mechanism

None
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers.
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.
Transfer to sub-processor: Jamf
ensures that the data processing
agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.
Transfer to sub-processor: Data istransferred externally to our subprocessors.
Transfer to sub-processor: EEA SCCs,
UK Addendum, and/or Swiss SCCs (asapplicable) for onward transfers to our
sub-processors.

South Africa

Purpose for transfer and any further
processing

Transfer to sub-processor: Jamf uses
AWS for our edge services to processdata in South Africa as part of Jamf Data
Policy, Private Access, Threat Defense,and Safe Internet. Jamf Connect andProtect include features that may also
use these edge services. Data related tothese products and features is thentransferred to Ireland or the United States(hosting option for Jamf Safe Internet
only) for storage and further processing.
Please see our list of sub-processors for
specific information.

The frequency of the transfer

Categories of personal data transferred
Sensitive data transferred

Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Supplemental Organizational, Technical,
and Contractual Security Measures

Jamf Policy for Law Enforcement
Requests to Client Data

Transfer to sub-processor: Data istransferred continuously to AWS for
customers in this region for their edge
services.
See Section B of Schedule 1 to Jamf’s
DPA.
None
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers.
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.
Transfer to sub-processor: Jamf
ensures that the data processing
agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.

Length of processing chain

Applicable transfer mechanism

Transfer to sub-processor: Data istransferred externally to our subprocessors.
Transfer to sub-processor: EEA SCCs,
UK Addendum, and/or Swiss SCCs (asapplicable) for onward transfers to our
sub-processors.

South Korea

Purpose for transfer and any further
processing

Transfer to sub-processor: Jamf uses
AWS for our edge services to processdata in South Korea as part of Jamf Data
Policy, Threat Defense, and Safe Internet.
Jamf Protect includes features that may
also use these edge services. Data
related to these products and features isthen transferred to Ireland or the UnitedStates (hosting option for Jamf Safe
Internet only) for storage and further
processing.
Please see our list of sub-processors for
specific information.

The frequency of the transfer

Categories of personal data transferred
Sensitive data transferred
Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Transfer to sub-processor: Data istransferred continuously to AWS for
customers in this region for their edge
services.
See Section B of Schedule 1 to Jamf’s
DPA.
None
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to itscustomers.

Supplemental Organizational, Technical,
and Contractual Security Measures

Jamf Policy for Law Enforcement
Requests to Client Data

Length of processing chain

Applicable transfer mechanism

Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.
Transfer to sub-processor: Jamf
ensures that the data processing
agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.
Transfer to sub-processor: Data istransferred externally to our subprocessors.
Transfer to sub-processor: EEA SCCs,
UK Addendum, and/or Swiss SCCs (asapplicable) for onward transfers to our
sub-processors.

Spain

Purpose for transfer and any further
processing

Transfer to sub-processor: Jamf uses
Google Cloud Platform for our edge
services to process data in Spain as partof Jamf Data Policy, Threat Defense, andSafe Internet. Jamf Protect includes
features that may also use these edge
services. Data related to these products
and features is then transferred to Irelandor the United States (hosting option for
Jamf Safe Internet only) for storage andfurther processing.

Please see our list of sub-processors for
specific information.

The frequency of the transfer

Categories of personal data transferred
Sensitive data transferred

Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Supplemental Organizational, Technical,
and Contractual Security Measures

Jamf Policy for Law Enforcement
Requests to Client Data

Length of processing chain

Transfer to sub-processor: Data istransferred continuously to Google Cloud
Platform for customers in this region for
their edge services.
See Section B of Schedule 1 to Jamf’s
DPA.
None
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers.
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.
Transfer to sub-processor: Jamf
ensures that the data processing
agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.
Transfer to sub-processor: Data istransferred externally to our subprocessors.

Applicable transfer mechanism

Transfer to sub-processor: EEA SCCs,
UK Addendum, and/or the Swiss SCCs
(as applicable) for onward transfers toour sub-processors.

Switzerland

Purpose for transfer and any further
processing

Transfer to sub-processor: Jamf uses
Microsoft Azure for our edge services toprocess data in Switzerland as part ofJamf Data Policy, Threat Defense, andSafe Internet. Jamf Protect includes
features that may also use these edge
services. Data related to these products
and features is then transferred to Irelandor the United States (hosting option for
Jamf Safe Internet only) for storage andfurther processing.
Please see our list of sub-processors for
specific information.

The frequency of the transfer

Categories of personal data transferred
Sensitive data transferred

Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Supplemental Organizational, Technical,
and Contractual Security Measures

Transfer to sub-processor: Data istransferred continuously to Microsoft
Azure for customers in this region for
their edge services.
See Section B of Schedule 1 to Jamf’s
DPA.
None
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers.
Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations that

offer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.

Jamf Policy for Law Enforcement
Requests to Client Data

Length of processing chain

Applicable transfer mechanism

Transfer to sub-processor: Jamf
ensures that the data processing
agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.
Transfer to sub-processor: Data istransferred externally to our subprocessors.
Transfer to sub-processor: EEA SCCs,
UK Addendum, and/or Swiss SCCs (asapplicable) for onward transfers to our
sub-processors.

SwedenInternal transfer: Jamf has an office inSweden, and employees there may needto process customer’s personal data forthe purposes of support.

Purpose for transfer and any further
processing

Transfer to sub-processor: Jamf uses
AWS for our edge services to processdata in Sweden as part of Jamf Data
Policy, Threat Defense, and Safe Internet.
Jamf Protect includes features that may
also use these edge services. Data
related to these products and features isthen transferred to Ireland or the UnitedStates (hosting option for Jamf Safe
Internet only) for storage and further
processing.

Please see our list of sub-processors for
specific information.
Internal transfer: Data is transferred asneeded to provide support.
The frequency of the transfer

Categories of personal data transferred

Transfer to sub-processor: Data istransferred continuously to AWS for
customers in this region for their edge
services.
See Section B of Schedule 1 to Jamf’s
DPA.

Sensitive data transferred

NoneInternal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.

Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers.
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.

Supplemental Organizational, Technical,
and Contractual Security Measures

Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.

Jamf Policy for Law Enforcement
Requests to Client Data

Internal Transfer: Jamf’s DPA compels
us to notify our customer of requests
unless explicitly prohibited from doing so
by law. Please note that Jamf does notand cannot conduct real-time
surveillance of customers. To date, Jamf
has not received a request from law
enforcement for client data.
Transfer to sub-processor: Jamf
ensures that the data processing
agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.
Internal transfer: Data is transferredinternally within Jamf.

Length of processing chain

Transfer to sub-processor: Data istransferred externally to our subprocessors.
Internal transfer: EEA SCCs, UK
Addendum and/or Swiss SCCs, which
are incorporated into Jamf’s DPA.

Applicable transfer mechanism

Transfer to sub-processor: EEA SCCs,
UK Addendum, and/or Swiss SCCs (asapplicable) for onward transfers to our
sub-processors.

TaiwanPurpose for transfer and any further
processing

Internal transfer: Jamf has an office in
Taiwan, and employees there may needto process the customer’s personal data
for the purposes of support or hosting
services.

The frequency of the transfer

Internal transfer: Data is transferred asneeded to provide support or hosting
services.

Categories of personal data transferred

See Section B of Schedule 1 to Jamf’s
DPA.

Sensitive data transferred
Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Supplemental Organizational, Technical,
and Contractual Security Measures

Jamf Policy for Law Enforcement
Requests to Client Data

Length of processing chain

Applicable transfer mechanism

None
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.
Internal Transfer: Jamf’s DPA compels
us to notify our customer of requests
unless explicitly prohibited from doing so
by law. Please note that Jamf does notand cannot conduct real-time
surveillance of customers. To date, Jamf
has not received a request from law
enforcement for client data.
Internal transfer: Data is transferredinternally within Jamf.
Internal transfer: EEA SCCs, UK
Addendum, and/or Swiss SCCs (asapplicable), which are incorporated into
Jamf’s DPA.

United Kingdom
Internal transfer: Jamf has an office inthe United Kingdom, and employees
there may need to process customer’s
personal data for the purposes of
support.
Transfer to sub-processor: Jamf Pro
and Protect use AWS to store data in the
United Kingdom.

Purpose for transfer and any further
processing

Jamf uses AWS for our edge services toprocess data in the United Kingdom aspart of Jamf Data Policy, Private Access,Threat Defense, and Safe Internet. Jamf
Connect and Protect include featuresthat may also use these edge services.
Data related to these products andfeatures is then transferred to Ireland or
the United States (hosting option for
Jamf Safe Internet only) for storage andfurther processing.
Please see our list of sub-processors for
specific information.
Internal transfer: Data is transferred asneeded to provide support.

The frequency of the transfer

Categories of personal data transferred
Sensitive data transferred
Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Transfer to sub-processor: Data istransferred continuously to AWS for
customers in this region for hosting oredge services.
See Section B of Schedule 1 to Jamf’s
DPA.
None
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.

Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers.
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA and on
Jamf’s Security Portal.

Supplemental Organizational, Technical,
and Contractual Security Measures

Jamf Policy for Law Enforcement
Requests to Client Data

Length of processing chain

Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.
Internal Transfer: Jamf’s DPA compels
us to notify our customer of requests
unless explicitly prohibited from doing so
by law. Please note that Jamf does notand cannot conduct real-time
surveillance of customers. To date, Jamf
has not received a request from law
enforcement for client data.
Transfer to sub-processor: Jamf
ensures that the data processing
agreements with its sub-processors haveappropriate obligations with respect tolaw enforcement requests to enable Jamf
to comply with Jamf’s obligations tocustomers under our DPA.
Internal transfer: Data is transferredinternally within Jamf.

Transfer to sub-processor: Data istransferred externally to our subprocessor.
Internal transfer: EEA SCCs, UK
Addendum and/or Swiss SCCs, which
are incorporated into Jamf’s DPA.
Applicable transfer mechanism

Transfer to sub-processor: EEA SCCs,
UK Addendum and/or Swiss SCCs foronward transfer to our sub-processor.

United States
Internal transfer: Jamf’s headquarters
and many offices are located in the
United States, and employees there mayneed to process customer personal data
for the purposes of support, security
operations, or hosting services.
Transfer to sub-processor: Jamf
Connect, Now, Pro, Protect, Safe
Internet, and School uses AWS to store
data in the United States.
Purpose for transfer and any further
processing

Jamf uses AWS for our edge services toaccess data in the United States as partof Jamf Data Policy, Private Access,Threat Defense, and Safe Internet. Jamf
Connect and Protect include featuresthat may also use these edge services.
Data for these products and features isthen transferred to Ireland for storage
and further processing.
Please see our list of sub-processors for
specific information.

The frequency of the transfer

Internal transfer: Data is transferred asneeded to provide support, security
operations, or hosting services.

Transfer to sub-processor: Data istransferred continuously to AWS for
customers in this region for hosting oredge services.
Categories of personal data transferred

See Section B of Schedule 1 in Jamf’s
DPA.

Sensitive data transferred

None.
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA andon Jamf’s Security Portal.

Applied restrictions or safeguards thattake into consideration the nature of thedata and the risks involved

Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers its
customers.
Internal transfer: Jamf’s security
measures for internal transfers are set
forth in Schedule 3 of Jamf’s DPA andon Jamf’s Security Portal.

Supplemental Organizational, Technical,
and Contractual Security Measures

Transfer to sub-processor: Jamf enters
into appropriate data processing
agreements with all sub-processors that
include data protection obligations thatoffer at least the same protection of
personal data that Jamf offers to its
customers. Sub-processors have beenverified by Jamf’s Information Security
team to have sufficient technical andorganizational security measures.

Jamf Policy for Law Enforcement
Requests to Client Data

Internal Transfer: Jamf’s DPA compels
us to notify our customer of requests
unless explicitly prohibited from doing so
by law. Please note that Jamf does notand cannot conduct real-time
surveillance of customers. To date, Jamf
has not received a request from law
enforcement for client data.
Transfer to sub-processor: Jamf
ensures that the data processing
agreements with its sub-processors
have appropriate obligations withrespect to law enforcement requests toenable Jamf to comply with Jamf’s
obligations to customers under our DPA.
Internal transfer: Data is transferredinternally within Jamf.

Length of processing chain

Applicable transfer mechanism

Transfer to sub-processor: Data istransferred externally to our subprocessor.
Internal transfer: To the extent
applicable, the EEA SCCs, UK
Addendum and/or Swiss SCCs, which
are incorporated into Jamf’s DPA.
Transfer to sub-processor: To theextent applicable, the EEA SCCs, UK
Addendum, and/or Swiss SCCs foronward transfers to our sub-processors.

LAST UPDATED: May 22, 2024
V05222024