10x Genomics Chromium Flex single-cell RNA sequencing of first-trimester human decidua basalis

Data Access Agreement (DAA) for controlled access to sequencing data of < 10x Genomics Chromium Flex single-cell RNA sequencing of first-trimester human decidua basalis > Table of Content Section I: Dataset Details 2 I.a. Dataset Accession Number(s) 2 I.b. Dataset Reference / Name of Project 2 Section II: Contact and Project Information 3 II.a. Data Recipient 3 II.b. Authorized Representative of the Data Recipient 3 II.c. Data Controller(s) 4 II.d. Authorized Representative of the Data Controller(s) 4 II.e. Title of the Proposed Research Project 5 II.f. Research Project 5 II.g. Research Credentials 5 Section III: Data Access Agreement (DAA) 6 IV.a. Definitions 6 IV.b. Terms and Conditions 7 IV.c. Signature Page 12 Section IV: Annexes 13 IV.a. Annex 1: 13 IV.b. Annex 2: 16 IV.c. Annex 3: 17 Section I: Dataset Details I.a. Dataset Accession Number(s) Please do not change this section, which lists the EGA accession numbers of the dataset for which access is requested. ________________________________________ I.b. Dataset Reference / Name of Project Please do not change this section, which lists the publication or project that established the dataset for which access is requested. ________________________________________ Section II: Contact and Project Information II.a. Data Recipient (Institution that receives Data with Principal investigator who is overseeing the proposed research) Please ensure that a full postal address and a valid Institutional email address are included Institution’s name: Institution’s address: Institutions’ website: Principal investigator full name: Principal investigator institutional e-mail address: Principal investigator institutional website: Principal investigator institutional postal address: II.b. Authorized Representative of the Data Recipient (e.g., Institute Director or Department Chair) This person needs to have the right to sign the Data Access Agreement in the name of the host institution of the Data Recipient. Authorized Representative full name: Authorized Representative role at the host institution: Authorized Representative institutional e-mail address: Authorized Representative institutional website: Authorized Representative institutional postal address: II.c. Data Controller(s) Please do not change this section, which lists the data controller and provider of the dataset. Data Controller full name: Medical University of Vienna Data Controller institutional e-mail address: Data Controller institutional website: https://meduniwien.ac.at Data Controller institutional postal address: Spitalgasse 23, 1090 Wien, Österreich Host institution name: Medical University of Vienna Host institution website: https://meduniwien.ac.at II.d. Authorized Representative of the Data Controller(s) Please do not change this section, which lists the authorized representative of the data controller and provider of the dataset. Authorized Representative: Authorized Representative institutional e-mail address: Authorized Representative institutional website: Authorized Representative institutional postal address: Host institution name: Host institution website: II.e. Title of the Proposed Research Project ________________________________________ II.f. Research Project (Scientific Abstract) Provide a clear and short description of the project, its stakeholders, its main question and its relevance to the research domain addressed, its specific aims, and duration (~300 words). Note that any use of the Data, if approved, must fall under the framework of the described project. ________________________________________ II.g. Research Credentials (optional) Provide a list of three scientific publications relevant to the planned project, of which the Data Recipient is author or co-author. In addition, please attached the Data Recipient’s scientific CV. ________________________________________ Section III: Data Access Agreement (DAA) IV.a. Definitions GDPR: This DAA makes both parties compliant with the Regulation (EU) 2016/679 of the European Parliament and of the Council, that is, the General Data Protection Regulation (herein referred to as the ‘GDPR’). [1] Confidential Information: Means, including without limitation, know-how, technology, methodologies, procedures, data, business- and trade secrets, information related to the Data or other information, which according to its content, is to be classified as confidential, whether marked confidential or not, in any form whatsoever, and disclosed by Data Controller to Data Recipient for the purpose of this Agreement. Data: Refers to controlled access data specified in Section I.a (the Data). Under this Agreement, the Data is pseudonymized. Purpose: Means the Research Project described in Section II.g, for which access to the Data has been granted under this Agreement. Data Access/Transfer: Refers to an Institution’s right to request access to the Data and retrieve them from the Data Controller’s Institution upon approval of this DAA by the corresponding DAC within the Data Controller’s Institution. Data Handling: Refers to an Institution’s ability to analyze and manipulate the Data within its own computer network. Data Controller(s): Refers to an Institution, responsible for the generation of the Data and its pseudonymization. A key-code permitting relinkage to Data Subjects is kept by the Data Controller(s). Data Subject: Refers to any individual who is the source of any Data covered by this Agreement. Data Recipient: Refers to the Institution who requests Access to the Data through this Agreement. Authorized Personnel: The individual(s) at the Institution requesting Access to the Data. Research Project: The project specified in Section II.g for which Data Recipient has requested Access to the Data. Publications: Refers, without limitation, to any and all articles published in print journals, electronic journals, preprints, reviews, books, posters, abstracts, presentations and other written and verbal presentations of the Research Project. Parties: The Data Controller(s) and the Data Recipient are hereinafter individually referred to by their name and collectively as the “Parties.” IV.b. Terms and Conditions In signing this Agreement: 1. Data Recipient agrees to only use the Data for the purpose of the Research Project defined above. 2. Data Recipient agrees to preserve, at all times, the confidentiality of information and Data pertaining to Data Subjects. Data Recipient undertakes not to use or attempt to use the Data to compromise or otherwise infringe the confidentiality of information on Data Subjects and their right to privacy. 3. The Parties acknowledge that applicable laws or regulations – including, but not limited to, the Austrian Informationsfreiheitsgesetz (IFG) – may require the Provider to publicly disclose certain information to guarantee transparency. Such information may include details of contractual relationships, payments, and agreements, even if such information is otherwise considered confidential. Accordingly, the Parties agree that the Provider may, either proactively or upon specific request, disclose such information in accordance with applicable legal provisions, both during the term of this Agreement and thereafter, provided that a) such disclosure is legally required or permitted; and b) the disclosure is limited strictly to the extent necessary under applicable law. 4. Data Recipient agrees not to attempt to identify Data Subjects. 5. Data Recipient and its Authorized Personnel agree to abide by any specific usage restrictions attached to the Data as communicated by the Data Controller, as well as any usage restrictions stemming from applicable laws or the internal policies of your Institution. 6. Data Recipient agrees that in handling this Data will follow an up-to-date information technology (IT) policy that must include, at a minimum, the following items: a. Logging and auditing of access to the Data and to the computer network; b. Strong authentication for all accounts accessing the Data, including multi-factor authentication where technically feasible, and/or strong data encryption; c. Virus and malware protection to computers on the computer network; d. Any backups must be secured to the same or an equivalent standard as the original storage. 7. Data Recipient acknowledges that access to the Data is granted solely for the Research Project described in Section II.g. Any use of the Data for a different project, including projects within the same research field or area, shall require approval under a separate Data Access Agreement. 8. Upon termination, Data Recipient must securely delete received data and any backup thereof provide with a signed certificate of destruction, subject to any mandatory retention periods required by applicable law or GDPR accountability obligations. 9. Processing of the Data is subject to the Data Protection Laws, including GDPR. 10. Nothing in this Agreement shall operate to transfer to the Data Recipient any intellectual property rights in the Data. 11. The Data Recipient may seek intellectual property protection for results solely generated by Data Recipient through the Research Project, provided that such protection is not asserted in a manner that prevents bona fide academic research use of those results or the Data. 12. If Results are generated by collaborative efforts of the Provider and the Recipient, such Results shall be held in co-ownership by the Parties. If requested by either Party, or if a Party wishes to use such Results for commercial purposes, a joint ownership or licence agreement shall be negotiated between the Parties in good faith. For the avoidance of doubt, the Provider shall have no obligation to enter into such joint ownership or license agreement. 13. Data Recipient agrees that the Data Controller (1) bears no legal responsibility for the accuracy or comprehensiveness of the Data; (2) accepts no liability for indirect, consequential, or incidental damages or losses arising from use of the Data, except to the extent such limitation is not permitted by law or when the damages are caused by Data Controller’s negligence or willful misconduct; and (3) bears no responsibility for the further analysis or interpretation of these Data over and above that published by the Data Controller(s). 14. The Data is provided by the Data Controller without any warranties whatsoever, express or implied, including any warranties for merchantability or fitness for a particular purpose, or that the use of the Data will not infringe upon any patent, copyright, trademark, or other rights. 15. Except to the extent prohibited by law, Data Recipient assume all liability for duly evidenced demands, damages, expenses, and losses arising out of use of the Data described in Section II.g . Data Controller(s) and Data Subject(s) will not be liable to Data Recipient for any loss, claim or demand made by Data Recipient, or made against the Data Recipient by any other party, due to or arising from Data Recipient use of the Material, except to the extent permitted by law when caused by the gross negligence or willful misconduct of the Data Controller(s). 16. The Parties agree that, as personal data of Data Subjects will be transferred to the Recipient in pseudonymized form only, as between them, the Data Controller is best able to manage requests from data subjects according to the GDPR, such as their rights for access, rectification, erasure, restriction of processing, data portability, as well as their right to object. Therefore, the Data Controller is designated as the first point of contact for the Data Subjects whose personal data is being processed under this an Agreement and in this Research Project. In the event that the Data Recipient receives a request from a data subject to exercise their rights as a Data Subject according to the GDPR, the Data Recipient will refer the Data Subject to the Data Controller. Where necessary and appropriate, the Parties shall assist each other by providing the necessary information to ensure that the rights of Data Subjects are fully and effectively implemented. Should the Data Recipient´s assistance be necessary, information will be shared through the use of a Research Project-specific identification number. 17. In no event shall the Data Controller be liable for any use by the Data Recipient of the Data and/or Results, or any loss, claim, damage or liability of whatsoever kind of nature, which may arise from or in connection with this Agreement or the use, handling, storage or deletion of the Data and/or Results, except for cases of Data Controller `s gross negligence, wilful misconduct or personal injury. The Data Recipient agrees to indemnify and hold the Data Controller harmless from any loss, claim, damage or liability that may arise in conjunction with the use, handling, storage or deletion of the Data by the Data Recipient, provided however, that Data Recipient’s obligation to indemnify will not apply to the extent such loss has been caused by the Data Controller’s gross negligence or wilful misconduct. The Data Recipient is responsible for compliance with all relevant statutes, legislation, regulations and guidelines applicable to the use, handling, storage and deletion of the Data. The Data Recipient will obtain all permits, licenses or other approvals required by governmental authorities and/or the competent ethics committee in connection with the receipt, handling, use, storage and deletion of the Data and provide proof thereof to the Data Controller upon request. 18. 19. These provision of this Agreement in no way prevents or restricts the Data Collector’s right to publish the Data or any document relating to the Data. 20. Data Recipient agrees to a moratorium on publishing global analyses of the dataset until the Data Controller(s) have published their own global analysis. 21. The Data Recipient may publish or otherwise publicly disclose its Results of the Research Project, but such public disclosure may be made only after the Data Controller has had forty-five (45) calender days to review the proposed disclosure to determine if it includes any Confidential Information of the Data Controller. The Data Controller has the right to request changes to such proposed disclosure, which the Data Recipient shall take into consideration in good faith. The Data Controller reserves the unrestricted right to have deleted from the disclosure all its Confidential Information which may be contained therein. In addition, at the request of the Data Controller, any sensitive matter will be withheld from disclosure to third parties for an additional ninety (90) calendar days if required in order to enable the Data Controller to apply for patent protection or similar protection rights. During such time, the Data Controller agrees to hold the publication confidential, but is free to incorporate the same in any patent application or regulatory filing. 22. Data Recipient agrees to acknowledge the contribution of the Data Controller(s) in all oral and written presentations, disclosures, and Publications resulting from all analyses of the Data. 23. Data Recipient agrees to use safe storage of the Data. Any Authorized Personnel shall work under Data Recipient direct supervision. Data Recipient agrees to distribute a copy of these terms to the Authorized Personnel. 24. The Data may be accessed solely by the Data Recipient and its Authorized Personnel for the Purpose of the Research Project. 25. Data Recipient may not transfer the Data itself to anyone outside this agreement, unless the Data Controller(s) has (have) approved such transfer and its terms in writing. 26. [If applicable] Since personal data (includes pseudonymized data) of data subjects will be transferred by the Provider to the Recipient, having its principal place of business in a country located outside the EU/EEA, Institution has to comply with the requirements of the GDPR for transferring data to a third country (Art 44-49 GDPR). Module 1 (controller-to-controller) of the clauses annexed to the EU Commission Decision 2021/914 of June 4, 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (OJ L 199, 7.6.2021, p. 31–61), as amended from time to time (“SCCs”), which are hereby incorporated by reference and completed as follows: the “data exporter” is the Provider; the “data importer” is the Recipient, the optional docking clause in Clause 7 is not applicable, the optional paragraph in Clause 11 (a) is struck; the governing law in Clause 17 is the law of Austria and the courts in Clause 18 (b) the courts of Austria; Annex 1 and 2 to the SCCs are Annex 1 and 2 to this Agreement respectively. 27. Should Data Recipient wish to share the Data with an external collaborator, the external collaborator must complete a separate Data Access Agreement approved by the Data Controller. 28. Data Recipient shall ensure that its Authorized Personnel has access to the Data and shall comply with the terms of this Agreement. Data Recipient remains solely and fully responsible for Data Recipient Authorized Personnel’s non-compliance with the provision of the Agreement and/or applicable laws. 29. In the event of any personal data breach affecting the Data, the Data Recipient shall notify the Data Controller(s) without undue delay and in any event no later than 72 hours after becoming aware of the breach, and provide all information reasonably required to enable the Data Controller(s) to comply with their obligations under the GDPR. 30. This Agreement shall become effective on the date of the last signature on the Signature Page. 31. Data Recipient accepts that this Agreement can be terminated by the Data Controller by thirty (30) days prior written notice. 32. The Parties shall endeavor to settle any dispute arising out of or in connection with this Agreement amicably. If no resolution is reached, the dispute shall be governed by and construed in accordance with the laws of Austria, and the dispute shall be submitted to the exclusive jurisdiction of the competent courts of Austria. 33. The Data is provided at no costs. 34. Neither Party shall assign, transfer, subcontract, or deal in any other manner with all or any of its rights or obligations under this Agreement without the prior written consent of the other Party. 35. No modifications to this Agreement shall be binding unless executed in writing by the authorized signatories of the Parties. 36. If any provision of this Agreement is held to be invalid or void, the Parties undertake to agree on a similar but valid provision. The invalidity of one provision shall not affect the validity of the remaining provisions. 37. Any provisions of this Agreement which by their nature extend beyond termination (including, but not limited to, obligations of confidentiality, data protection, and liability) shall survive the termination or expiration of this Agreement. 38. This Agreement may be signed in counterparts, each of which will be deemed to be an original. The Parties agree that this Agreement may be executed by electronic signature, which will be considered as an original signature for all purposes and will have the same legal force and effect. IV.c. Signature Page I have read, understood and agree to abide by the terms and conditions stipulated in this Data Access Agreement. Data Recipient Full Name: Authorized Representative: : Date: ____________________ Signature: _______________________________________ Data Controller: Full Name: Position: : Date: ____________________ Signature: _______________________________________ Section IV: Annexes (Section IV only applies in case Clause 26 of the DUA is applicable.) IV.a. Annex 1: MODULE 1 TRANSFER CONTROLLER TO CONTROLLER Description of the Transfer A. LIST OF PARTIES Data Exporter: Name: Medical University of Vienna Address: Spitalgasse 23, 1090 Vienna, Austria Contact person’s name, position and contact details: Christoph Bock, christoph.bock@meduniwien.ac.at Activities relevant to the data transferred under these Clauses: Transferring Data in accordance with the Project Plan and the Data Transfer Agreement entered into between the Data Exporter and the Data Importer. Signature and date: See signature block on previous page Role (controller/processor): Controller Data Importer: Name: To be completed Address: To be completed Contact person’s name, position, and contact details: To be completed Activities relevant to the data transferred under these Clauses: Conducting the Project in accordance with the Project Plan and the Data Transfer Agreement entered into between the Data Exporter and the Data Importer. This includes conducting certain data analyses, evaluations, and publications. Signature and date: See signature block on previous page Role (controller/processor): Controller B. DESCRIPTION OF TRANSFER. Categories of data subjects whose personal data is transferred: [X] Project participants [ ] Other (please specify): Categories of Personal Data. The Personal Data processed concerns the following data categories for project participants: Data categories are defined in the current version of the Project Plan, Exhibit 2 and in the underlying Data Transfer Agreement. The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis). [X] One-off. — The Data is transmitted once. [ ] Continuous. — Data will be transferred on a continuous basis throughout the duration of the underlying Data Transfer Agreement. Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures. [ ] Special categories of personal data — WILL NOT be transferred. OR [X] Special categories of personal data — WILL be transferred. Select the relevant special categories of personal data to be transferred: [ ] Health data (e.g. responses health questionnaires; diagnosis; laboratory parameters etc.) [ ] Genetic data (e.g. reports revealing predisposition to certain diseases) [ ] Race or ethnicity (e.g. information identifying an individual as a particular race or ethnic origin) [ ] Other. (please specify): Nature of the processing. Conducting the Project by data importer in accordance with the Project Plan and the Data Transfer Agreement entered into between the Data Exporter and the Data Importer. This includes conducting certain data analyses, evaluations, and publications. Purpose(s) of the data transfer and further processing. As stated in the Project Plan and Data Transfer Agreement. The period for which the Personal Data will be retained, or, if that is not possible, the criteria used to determine that period: As stated in the Project Plan and Data Transfer Agreement. Personal Data will be stored in accordance with applicable laws and kept as long as needed to carry out the purposes described the Data Transfer Agreement. C. COMPETENT SUPERVISORY AUTHORITY The Supervisory Authority of Austria shall act as competent Supervisory Authority. IV.b. Annex 2: Security Measures [EXPLANATORY NOTE: The technical and organisational measures must be described in specific (and not generic) terms. See also the general comment on the first page of the Appendix, in particular on the need to clearly indicate which measures apply to each transfer/set of transfers. Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.] Examples of possible measures: Measures of pseudonymisation and encryption of personal data Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing Measures for user identification and authorisation Measures for the protection of data during transmission Measures for the protection of data during storage Measures for ensuring physical security of locations at which personal data are processed Measures for ensuring events logging Measures for ensuring system configuration, including default configuration Measures for internal IT and IT security governance and management Measures for certification/assurance of processes and products Measures for ensuring data minimisation Measures for ensuring data quality Measures for ensuring limited data retention Measures for ensuring accountability Measures for allowing data portability and ensuring erasure IV.c. Annex 3: Transfer Impact Assessment (TIA) One of the central innovations of the standard data protection clauses issued by the European Commission is the obligation to conduct a comprehensive and case-by-case data transfer impact assessment (hereinafter: "TIA") in the context of a third country transfer. In doing so, the data exporter and data importer (hereinafter: the parties) must conduct a risk assessment that takes into account all factors associated with the transfer of data to third countries. As a result, the Parties should have no reason to believe that the data importer will not be able to comply with the standard data protection clauses due to local laws and practices in the recipient country. Contract underlying the TIA: Please enter here the name of the contractual basis (such as Main Agreement) and if applicable the name of the e.g. research project/study/clinical trial) based on which why this TIA is completed. [ ] Date of TIA [ ] Last change to the TIA on: Click or type to enter a date. If any information in this TIA changes, it is the duty of the data importer to notify the data exporter so that it can be adjusted accordingly. I. Circumstances of the transfer Who is the transmitter of the data (data exporter)? Medical University of Vienna, Spitalgasse 23, 1090 Vienna. To whom is the data transmitted, i.e. who is the recipient of the data (data importer)? Please state the name of the data importer here, e.g. the institution and address. Describe the processing activity: Conducting the Project in accordance with the Project Plan by data importer and the Data Transfer Agreement entered into between the Data Exporter and the Data Importer. This includes conducting certain data analyses, evaluations, and publications. Where (geographically, address) will the data be transferred? Please add: Where is the data stored? If the data is stored within the EU/EEA, is there theoretically the possibility of remote access to the data from a third country? Please specify the country where the data is stored Categories of data subjects whose personal data is transferred: [ ] Study participants [ ] Project participants [ ] Principal Investigator and study/project participants [ ] Other: Click or type here to enter The Personal Data processed concerns the following data categories for study participants: Data categories are defined in the current version of the Project Plan and in the underlying Data Transfer Agreement. Identify any onward transfer: [ ] Not applicable [ ] Yes: If yes, please insert the entities. II. Transmission Tool Transfer Tool Standard data protection clauses (SCCs) III. Assess whether the transfer tool under Article 46 GDPR on which you rely is legally valid, taking into account all the circumstances of the transfer Are you aware of any laws applicable to you in your country that may require you to disclose to public authorities’ personal data that you have received from us (e.g. Foreign Intelligence Surveillance Act, Section 702; EO 12333 and Presidential Policy Directive 28 ("PPD- 28"))? Click or type here to enter text. Do you qualify as an electronic communication service provider within the meaning of 50 USC § 1881(b)(4)? (i.e. as a telecommunications carrier, provider of electronic communication service, provider of a remote computing service, any other communication service provider who has access to wire or electronic communications either as such communications are transmitted or as such communications are stored or an officer, employee, or agent of any such entity) Click or type here to enter text. Do you cooperate in any respect with US authorities conducting surveillance of communications under EO 12.333, irrespective of whether it’s mandatory or voluntary? Click or type here to enter text. How is the data protection law regime exercised in practice by courts or authorities? Click or type here to enter text. Have you received any such requests in the past from public authorities to disclose personal data received from or processed on behalf of customers? If yes, how often? [ ] Yes [ ] No Do the above-mentioned authorities inform you, the data importer or the data subjects about an access? [ ] Yes [ ] No [ ] Under these circumstances: Click or type here to enter text. What legal remedies could you, the data importer or the data subjects have against access by the authorities? Please describe the possible remedies here. How do you respond to requests for disclosure of personal data by public authorities? Do you have an internal policy on this? Please describe here your experiences with such requests regarding the relevant data. Have you implemented technical and organizational measures to prevent access to personal data by third parties without your active intervention? Please describe here Are EU standards, such as Article 47 (right to an effective remedy and to a fair trial) and 52 (scope and interpretation of rights and principles) of the EU Charter of Fundamental Rights respected? [ ] Yes, according to the current state of knowledge without exception. [ ] Yes, with the exception of Click or type here to enter text. [ ] No. III. Assess whether the transfer tool under Article 46 GDPR on which you rely is legally valid, taking into account all the circumstances of the transfer Are you aware of any laws applicable to you in your country that may require you to disclose to public authorities’ personal data that you have received from us (e.g. Foreign Intelligence Surveillance Act, Section 702; EO 12333 and Presidential Policy Directive 28 ("PPD- 28"))? Click or type here to enter text. Do you qualify as an electronic communication service provider within the meaning of 50 USC § 1881(b)(4)? (i.e. as a telecommunications carrier, provider of electronic communication service, provider of a remote computing service, any other communication service provider who has access to wire or electronic communications either as such communications are transmitted or as such communications are stored or an officer, employee, or agent of any such entity) Click or type here to enter text. Do you cooperate in any respect with US authorities conducting surveillance of communications under EO 12.333, irrespective of whether it’s mandatory or voluntary? Click or type here to enter text. How is the data protection law regime exercised in practice by courts or authorities? Click or type here to enter text. Have you received any such requests in the past from public authorities to disclose personal data received from or processed on behalf of customers? If yes, how often? [ ] Yes [ ] No Do the above-mentioned authorities inform you, the data importer or the data subjects about an access? [ ] Yes [ ] No [ ] Under these circumstances: Click or type here to enter text. What legal remedies could you, the data importer or the data subjects have against access by the authorities? Please describe the possible remedies here. How do you respond to requests for disclosure of personal data by public authorities? Do you have an internal policy on this? Please describe here your experiences with such requests regarding the relevant data. Have you implemented technical and organizational measures to prevent access to personal data by third parties without your active intervention? Please describe here Are EU standards, such as Article 47 (right to an effective remedy and to a fair trial) and 52 (scope and interpretation of rights and principles) of the EU Charter of Fundamental Rights respected? [ ] Yes, according to the current state of knowledge without exception. [ ] Yes, with the exception of Click or type here to enter text. [ ] No. V. Take additional measures Technical implementation of the transfer? Please explain here any additional measures you have taken Have measures been applied to safeguard the personal data while in transit? Please explain here any additional measures you have taken What additional measures, beyond the SCC agreement, are in place to protect personal data (e.g., individual contractual agreements, technical or organizational safeguards, a process for challenging regulatory requests, and additional protections for data subjects? Please explain here any additional measures you have taken IV. Result Overall Conclusion: The transfer can go ahead because: The transfer can NOT go ahead because: FOOTNOTES [1] See https://gdpr-info.eu/ [Accessed 1 November 2019]