Data Transfer Impact Assessment

Overview

This document provides information to help iSpring customers conduct data transfer impact assessments in connection with their use of iSpring Products and Services (collectively-Products), in light of the “Schrems II” ruling of the Court of Justice for the European Union and the recommendations from the European Data Protection Board.

In particular, this document describes the legal regimes applicable to iSpring in the US, the safeguards iSpring puts in place in connection with transfers of customer personal data from the European Economic Area, the United Kingdom and Switzerland ("Europe"), and iSpring ability to comply with its obligations as "data importer" under the Standard Contractual Clauses ("SCCs").

Step 1: Know your transfer

Where iSpring processes personal data governed by European data protection Laws as a data processor (on behalf of our customers), iSpring complies with its obligations under its Data Processing Agreement (hereinafter-DPA).

iSpring’s DPA incorporates the SCCs and provides the following information:

• description of iSpring’s processing of customer personal data; and
• description of iSpring’s security measures;

Please refer to the DPA for information on the nature of iSpring's processing activities in connection with the provision of the Products, the types of customer personal data we process and transfer, and the categories of data subjects. We may transfer customer personal data wherever we or our third-party service providers operate for the purpose of providing the Products to Customers. The locations will depend on the particular iSpring Products which Customers use, as outlined in the chart below.

Step 2: Identification of Transfer tool

Where personal data originating from the European Economic Area is transferred to iSpring, iSpring relies upon the European Commission's SCCs to provide an appropriate safeguard for the transfer. Where customer personal data originating from the European Economic Area is transferred by iSpring to third-party sub processors, iSpring enters into SCCs with those parties.

Step 3: Identification of Applicable Laws and Regulations in light of transfer

3.1 U.S. Surveillance Laws

3.2 FISA 702 and Executive Order 12333

The following US laws were identified by the Court of Justice of the European Union in Schrems II as being potential obstacles to ensuring essentially equivalent protection for personal data in the US:

• FISA Section 702 (“FISA 702”) – allows US government authorities to compel disclosure of information about non-US persons located outside the US for the purposes of foreign intelligence information gathering. This information gathering must be approved by the Foreign Intelligence Surveillance Court in Washington, DC. In-scope providers subject FISA 702 are electronic communication service providers ("ECSP") within the meaning of 50 U.S.C § 1881(b)(4), which can include remote computing service providers ("RCSP"), as defined under 18 U.S.C. § 2510 and 18 U.S.C. § 2711.
• Executive Order 12333 ("EO 12333") - authorizes intelligence agencies (like the US National Security Agency) to conduct surveillance outside of the US. In particular, it provides authority for US intelligence agencies to collect foreign "signals intelligence" information, being information collected from communications and other data passed or accessible by radio, wire and other electromagnetic means. This may include accessing underwater cables carrying internet data in transit to the US. EO 12333 does not rely on the compelled assistance of service providers, but instead appears to rely on exploiting vulnerabilities in telecommunications infrastructure.

For implementation details please check U.S. Privacy Safeguards Relevant to SCCs and Other EU Legal Bases for EU-U.S.Data Transfers after Schrems II (https://www.commerce.gov/sites/default/files/2020-09/SCCsWhitePaperFORMATTEDFI NAL508COMPLIANT.PDF)¹

3.3 US Cloud Act

The Clarifying Lawful Overseas Use of Data (CLOUD) Act amended the Electronic Communications Privacy Act (ECPA), which is the US statute governing how law enforcement agencies may obtain information held by certain technology companies, including cloud service providers.

The CLOUD Act has two parts. The first part clarifies that orders issued under the existing statutory framework in ECPA can reach data regardless of where that data is stored. The second part creates a new framework for government-to-government agreements to govern cross-border law enforcement requests².

¹ Regarding FISA 702 the White paper notes: For most companies, the concerns about national security access to company data highlighted by Schrems II are “unlikely to arise because the data they handle is of no interest to the U.S. intelligence community.” Companies handling “ordinary commercial information like employee, customer, or sales records, would have no basis to believe US intelligence agencies would seek to collect that data.” There is individual redress, including for EU citizens, for violations of FISA section 702 through measures not addressed by the court in the Schrems II ruling, including FISA provisions allowing private actions for compensatory and punitive damages. Regarding Executive Order 12333 the whitepaper notes: EO 12333 does not on its own “authorize the U.S. government to require any company or person to disclose data.” Instead, EO 12333 must rely on a statute, such as FISA 702 to collect data. Bulk data collection, the type of data collection at issue in Schrems II, is expressly prohibited under EO 12333.

² The White paper notes: The CLOUD Act only permits U.S. government access to data in criminal investigations after obtaining a warrant approved by an independent court based on probable cause of a specific criminal act. The CLOUD Act does not allow U.S. government access in national security investigations, and it does not permit bulk surveillance

Do FISA 702, EO 12333 apply to iSpring?

iSpring, like most SaaS companies, could technically be subject to FISA 702. However, iSpring does not process personal data that is likely to be of interest to US intelligence agencies.

Step 4: Identification of the technical, contractual and organizational measures applied to protect the transferred data

4.1 Technical measurers iSpring is obligated to have in place appropriate technical and organizational measures to safeguard personal data (both under the Data Processing Agreement as well as the SCCs we enter into with customers, service providers).For technical measurers please see attached the iSpring Web Services: Overview of Security Processes.

4.2. Contractual measurers

Contractual measures are incorporated into iSpring’s DPA. Main requirements:

• Technical measures: iSpring is contractually obligated to have in place appropriate technical and organizational measures to safeguard personal data (both under the Data Processing Agreement as well as the SCCs we enter into with customers, service providers, and suppliers)
• Transparency: iSpring is obligated under the SCCs to notify its customers in the event it is made subject to a request for government access to customer personal data from a government authority. In the event that iSpring is legally prohibited from making such a disclosure, iSpring is contractually obligated to challenge such prohibition and seek a waiver.
• Actions to challenge access: Under the SCCs, iSpring is obligated to review the legality of government authority access requests and challenge such requests where they are considered to be unlawful.

4.3. Organizational measurers

• Onward transfers: Whenever we share Your data with iSpring affiliated parties, we remain accountable to You for how it is used. We require all our suppliers and vendors to undergo a thorough due diligence process.
• Privacy by design: iSpring’s Privacy Policy [VB2] outlines iSpring approach to privacy
• While processing the data, we use the help of the sub processers. A list of all of our data sub processors is available below:

Step 5: Procedural steps necessary to implement effective supplementary measures

Taking into account technical, contractual, and organizational measures iSpring has implemented to protect customer personal data, iSpring considers that the risks involved in transferring and processing European personal data in/to the US do not impinge on our ability to comply with our obligations under the SCCs (as "data importer") or to ensure that individuals' rights remain protected.

Step 6: Re-evaluate at appropriate intervals

iSpring will review and, if necessary, reconsider the risks involved and the measures it has implemented to address changing data privacy regulations and risk environments associated with transfers of personal data outside of the European Economic Area, the United Kingdom and Switzerland ("Europe").