APPENDIX II: Standard Contractual Clauses (Module 4)

These standard contractual clauses ensure compliance with Regulation (EU) 2016/679 (GDPR) for the transfer of personal data to a third country. They apply with respect to the transfer of personal data specified in Annex I.B. The Appendix forms an integral part of these Clauses.

These Clauses set out appropriate safeguards pursuant to Articles 46(1) and 46(2)(c) GDPR, provided they are not modified except to select Modules or update Appendix information. Parties may include these Clauses in a wider contract and add safeguards that do not contradict these Clauses or prejudice data subject rights.

Data subjects may invoke and enforce these Clauses as third-party beneficiaries against the data exporter and/or data importer, subject to the exceptions set out in the official Commission SCCs text for Module 4.

GDPR-defined terms have the same meaning here. These Clauses shall be read in light of the GDPR and shall not conflict with GDPR rights and obligations.

In the event of contradiction between these Clauses and related agreements between the Parties, these Clauses prevail.

Details of the transfer(s) are specified in Annex I.B.

An entity that is not a Party may, with agreement of the Parties, accede as data exporter or data importer by completing the Appendix and signing Annex I.A.

8.1 Instructions

The data exporter shall process personal data only on documented instructions from the data importer acting as its controller, and shall inform the importer if it cannot follow those instructions. After the end of processing services, the exporter shall, at the importer's choice, delete or return personal data processed on the importer's behalf.

8.2 Security of processing

The Parties shall implement appropriate technical and organisational measures to ensure security of the data, including during transmission, and to protect against personal data breaches. The exporter shall notify the importer without undue delay of a breach concerning data processed under these Clauses and ensure authorised persons are under confidentiality obligations.

8.3 Documentation and compliance

The Parties shall demonstrate compliance. The exporter shall make available information necessary to demonstrate compliance and allow for audits.

The Parties shall assist each other in responding to enquiries and requests made by data subjects under applicable local law or, for processing by the exporter in the EU, under the GDPR.

The data importer shall inform data subjects of a contact point authorised to handle complaints and shall deal promptly with complaints received.

Each Party is liable to the other for damages caused by breach of these Clauses. Each Party is liable to the data subject for material or non-material damages caused by breaching third-party beneficiary rights under these Clauses. Where more than one Party is responsible, they are jointly and severally liable.

Clause 12 — Local laws and practices

The Parties warrant they have no reason to believe that laws and practices in the third country of destination prevent the data importer from fulfilling its obligations under these Clauses, taking into account the specific circumstances of the transfer and applicable safeguards. The importer shall notify the exporter if it has reason to believe it can no longer meet this warranty.

Clause 13 — Access by public authorities

The data importer agrees to notify the exporter (and where possible the data subject) of legally binding disclosure requests or direct access by public authorities, to the extent permitted by law; to review legality and challenge unlawful requests; and to provide the minimum information permissible when responding.

Clause 14 — Non-compliance and termination

The importer shall promptly inform the exporter if it is unable to comply. The exporter may suspend transfers and, in the cases set out in the official SCC text, terminate the contract insofar as it concerns processing under these Clauses. Personal data transferred prior to termination shall be deleted or returned as required.

Clause 15 — Governing law

These Clauses shall be governed by the law of a country allowing for third-party beneficiary rights. The parties agree that this shall be the laws of your primary place of business, without regard to conflict-of-law principles, unless mandatory law requires otherwise.

Clause 16 — Choice of forum and jurisdiction

Any dispute arising from these Clauses shall be resolved by the competent courts associated with the governing law above, unless mandatory consumer protections require otherwise.

Data exporter(s)

Name: IMGFILETOOLS (operator of imgfiletools.com)
Address: Update with your registered business address
Contact: [email protected] / [email protected]
Activities: provision of services involving an international transfer of personal data from IMGFILETOOLS (data exporter) to the customer (data importer), where applicable.
Role: data processor.

Data importer(s)

Name / address / contact: as identified for the Client at contracting or first operation of the service (if not completed, the Client's details apply).
Role: data controller.

Description of transfer

• Data subjects: those whose data appears in files uploaded by the importer.
• Personal data: categories contained in uploaded files.
• Sensitive data: only if present in uploaded files, with purpose limitation and access restrictions.
• Frequency: when use of the services involves an international transfer from IMGFILETOOLS to the importer.
• Nature / purpose: communicate personal data to the importer as needed to provide the services.
• Retention: as strictly necessary to provide the services and thereafter as required by law or to assert/defend claims.

Version control: September 8, 2026