Data Transfer Impact Assessment

Introduction

Actioner is committed to protecting the personal data provided by our customers, especially when transferring this data to countries outside of our immediate region, whether for support, security, or processing by third parties.

To ensure the continuity of our services, Actioner may transfer Customer Data (as outlined in our Privacy Policy and Data Processing Addendum) beyond the borders of the United States or the European Union. This could involve Actioner staff in our global offices accessing personal data or, in certain situations, our vendors located outside the United States, or those within the U.S. with international operations.

Our transfer impact assessments detail the potential risks involved in moving Customer Data to these third countries and the additional precautions we, or our vendors, have implemented to protect this data. For specifics on data processing activities or retention times not directly related to these transfers, please refer to our Data Processing Addendum. Generally, the data subjects involved include Twilio's customers and their end-users. For information on our data transfers to vendors outside the United States, you can consult our list of sub-processors.

Scope of the Data Transfer Impact Assessment

The Actioner Data Transfer Impact Assessment (DTIA) encompasses both direct transfers and subsequent transfers related to the delivery of Actioner’s services. Actioner facilitates the movement of personal data from the European Economic Area (EEA), the United Kingdom (UK), and Switzerland (collectively referred to as "Europe") to nations that are either recognized as having an adequate level of data protection by European law or to those that have not received such adequacy verdicts.

In situations where an adequacy decision is not in place, we rely on Standard Contractual Clauses (SCCs) as our method for data transfer. For a more detailed explanation of these contractual measures, please see the section below. The subsequent sections will detail our approach to data transfers to the United States and other countries that have not been granted an adequacy decision, specifically in relation to the services mentioned.