In accordance with the DPA:

"16. Transfer of Data to Third Countries or International Organisations

16.1 Data Storage and Processing Facilities.

IRIS Connect will store and process Customer Data in compliance with the requirements of the data legislation for your country. For EU customers this means that we will store your data within the EU. For a UK customer, we will continue to store your data in the EU, although we commit to transferring your data to the UK should a change in data protection law require it.

16.2 Data Centre Information.

IRIS Connect Users Amazon AWS storage to store all of Customer Data. Detailed Information about these data centres is available here.

16.3 Location of Customer Data

16.3.1 Customers using the Europe platform (https://europe.irisconnect.com) data will be stored in Dublin, Ireland using Amazon AWS servers

16.3 .2 Customers using the US platform (https://us.irisconnect.com) data will be stored in North Virginia, America using Amazon AWS servers

16.3 .3 Customers using the Australia platform (https://oceania.irisconnect.com) data will be stored in Sydney, Australia using Amazon AWS servers

Further information refer to Appendix B

16.4 Any transfer of personal data to third countries or international organisations by the data processor shall only occur on the basis of documented instructions from the data controller. Such a transfer would always always take place in compliance with Chapter V GDPR for our EU customers and in compliance with Local Regulatory Framework for our customers outside of the EU including the UK.

16.5 In case transfers to third countries or international organisations, which the data processor has not been instructed to perform by the data controller, is required under EU, Member State, or Local Regulatory Framework to which the data processor is subject, the data processor shall inform the data controller of that legal requirement prior to processing unless that law prohibits such information on important grounds of public interest.

16.6 Without documented instructions from the data controller, the data processor therefore cannot within the framework of the Clauses:

transfer personal data to a data controller or a data processor in a third country or in an international organisation transfer the processing of personal data to a sub-processor in a third country have the personal data processed in by the data processor in a third country

16.7 The Clauses shall not be confused with standard data protection clauses within the meaning of Article 46(2)(c) and (d) GDPR, and the Clauses cannot be relied upon by the parties as a transfer tool under Chapter V GDPR.

16.8. IRIS Connect staff may access customer data for the sole purpose of fulfilling our obligations to the data processor. All access to data is carefully performed following secure processes and procedures."