These documents concern agreements with Sellforte Solutions Oy. The contracting entity in your Order Form determines the applicable terms. Terms for the other Sellforte contracting entity.
D1 Transfer authorization and structure
Transfer authorization. The Customer authorizes Sellforte and its authorized subprocessors to transfer Customer Personal Data outside the EEA, the United Kingdom, and Switzerland, and to access it remotely from those locations, to the extent necessary for the authorized functions in Annex C, including transfers to Sellforte, Inc., Sellforte Solutions UK Ltd, and any other Sellforte Affiliate listed in Annex C or added under DPA Section 7.2 (List and changes), and onward transfers by those recipients. Each transfer must rely on a mechanism in this Annex, and the Customer may rely on the Annex C location information. Where the SCCs are required, the Customer authorizes Sellforte to conclude them with the importer as exporter under Module Three and, where the Customer is itself the exporter for a transfer within the authorized service arrangements, to put them in place on the Customer’s behalf under the appropriate Module with the selections in Section D3 applied accordingly; completed copies are available on request. This authorization does not waive the notice and objection rights in DPA Section 7.2 (List and changes) or Sellforte’s obligations under DPA Section 13 (International transfers).
International processing is limited to Annex C and DPA Section 13 (International transfers). Transfers outside the EEA rely on an applicable adequacy decision or valid safeguards. Reliance on the EU-US Data Privacy Framework requires current recipient certification covering the data. Otherwise, Sellforte uses the SCCs in Decision (EU) 2021/914 where applicable, with required assessments and supplementary measures. These requirements also cover remote access and onward transfers.
D2 Restricted onward transfers
Where SCCs are required, they bind the relevant exporter and importer before access. Module Three applies to processor-to-subprocessor transfers; other transfers use the module or mechanism appropriate to the actual roles. The completed SCC annexes identify the parties and competent authority, describe the data, purposes, frequency and retention, and specify security measures and required subprocessor information. The SCCs prevail over conflicting terms and preserve enforceable data-subject rights.
The official SCC text is available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj/eng. The relevant processing agreement incorporates it with the required selections and completed annexes. This Annex does not replace those binding arrangements. Copies are available on request, with lawful confidentiality redactions.
D3 Intragroup safeguards
Sellforte's intragroup agreement with Sellforte, Inc. incorporates Module Three for Customer Personal Data processed on Sellforte’s behalf. Clause 7 (Docking) applies; Clause 9(a) uses general written authorization with 30 days' prior notice. Earlier access requires specific written authorization under DPA Section 7.2 (List and changes) and must be permitted by the transfer terms. The optional Clause 11 dispute-resolution provision does not apply. The Finnish Data Protection Ombudsman is the competent authority under Clause 13; Finnish law and courts apply under Clauses 17 and 18. Completed schedules identify the parties, processing, security measures, and authorized subprocessors. EU-to-UK Affiliate transfers rely on an applicable adequacy decision or other valid safeguard. Other Sellforte Affiliates listed in Annex C or added under DPA Section 7.2 (List and changes) accede to the intragroup agreement and its SCCs (Clause 7) with the same selections before accessing Customer Personal Data from outside the EEA or an adequate jurisdiction.
Sellforte assesses destination laws and practices before restricted transfers, applies necessary supplementary safeguards, and reviews relevant changes. A foreign authority's request does not itself authorize disclosure: applicable GDPR requirements, including Article 48, and transfer terms must be met. Sellforte follows applicable duties to assess and, where required, challenge requests, limit disclosure, and notify the Customer unless prohibited by law. If lawful protection cannot be maintained, Sellforte suspends the transfer and arranges a valid alternative or required return or deletion.
D4 UK and Swiss requirements
Restricted transfers governed by UK GDPR use a valid UK mechanism, including the ICO's UK Addendum or International Data Transfer Agreement where applicable, with completed information and selections. Swiss transfers use a valid mechanism with the required Swiss adaptations. An applicable adequacy decision may instead support the transfer within its scope. Mandatory transfer terms prevail over conflicting Agreement terms.
