Data Transfer Safeguards

1. Overview of Cross-Border Transfers

As a global omnichannel automation platform, Opimatic utilizes cloud infrastructure and global API integrations. When personal data originates from the European Economic Area (EEA), the United Kingdom (UK), or Switzerland and is transferred to servers or entities located outside those regions, Opimatic ensures that such transfers comply strictly with Chapter V of the GDPR and applicable local data protection laws.

2. Recognized Legal Mechanisms

Opimatic relies on officially recognized legal frameworks to legalize international data transfers, ensuring that data subjects retain enforceable rights and effective legal remedies:

• Adequacy Decisions: Where data is transferred to countries deemed by the European Commission or relevant authorities to provide an adequate level of data protection.
• Standard Contractual Clauses (SCCs): Contractual frameworks approved by regulatory bodies that impose direct data protection obligations on data importers and exporters.
• Supplementary Measures: Technical and organizational controls implemented to bridge legal gaps in foreign jurisdictions.

3. European Standard Contractual Clauses

For data transfers from the EEA to third countries lacking an adequacy decision, Opimatic incorporates the European Commission’s Standard Contractual Clauses (Controller-to-Processor and Processor-to-Processor modules) into our Data Processing Agreement (DPA). These clauses guarantee:

• Binding commitments by the data importer to protect personal data to EU standards.
• Transparent protocols regarding sub-processor engagement and notification.
• Clear liability distribution and audit provisions.

4. UK & Swiss Data Transfers

For data originating in the United Kingdom or Switzerland, Opimatic applies the UK International Data Transfer Addendum (IDTA) to the EU SCCs, or equivalent Swiss Federal Act on Data Protection (FADP) contractual standards, ensuring seamless compliance across British and Swiss regulatory jurisdictions.

5. Technical & Organizational Safeguards

To mitigate risks associated with cross-border transit, Opimatic enforces rigorous technical safeguards:

• End-to-End Encryption: All personal data is encrypted in transit using TLS 1.3 / 256-bit SSL protocols and at rest using AES-256 encryption.
• Key Management: Encryption keys are managed securely and isolated from underlying cloud storage infrastructure.
• Pseudonymization: Where feasible, user identifiers and communication logs are pseudonymized to reduce exposure risk during transit.

6. Response to Government Access Requests

Opimatic is committed to protecting user data from unlawful surveillance. In the event we receive a legally binding request for customer personal data from any law enforcement or government intelligence agency:

• We will challenge the request if we identify legal deficiencies or overbreadth.
• To the extent permitted by law, we will promptly notify the affected Customer so they may seek protective orders.
• We disclose only the minimum amount of data strictly mandated by the valid legal order.

7. Compliance Inquiries

If you require documentation of our transfer safeguards, wish to execute our DPA with pre-signed SCCs, or have questions regarding cross-border compliance, please contact our legal team: