These Standard Contractual Clauses (“SCCs”) implement Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679. Where the Customer is established in the EEA, UK, or Switzerland and personal data is transferred to Verdeshell Technologies Pvt Ltd in India, the SCCs apply on a Module Two (controller → processor) basis and form an integral part of the Data Processing Addendum.
1. Parties
Data exporter (Controller): the Customer entity identified in the Order Form executing the DPA. Data importer (Processor): Verdeshell Technologies Pvt Ltd, registered in India, operating the Cortex service.
2. Module and clauses incorporated
- Module Two: transfers from controller to processor.
- Clauses 1 to 18 of Decision (EU) 2021/914 are incorporated by reference.
- Optional clauses 7 (docking) and 11(a) (independent dispute resolution) are not elected.
- Governing law (Clause 17): law of the Republic of Ireland.
- Forum (Clause 18): courts of Ireland; data subjects retain rights to lodge claims in their member state of residence.
3. Annex I — Description of transfer
Categories of data subjects, categories of personal data, frequency, retention, and purpose are described in clauses 3 to 5 and 9 of the Data Processing Addendum. Personal data is transferred continuously for the duration of the Customer’s subscription.
4. Annex II — Technical and organisational measures
Measures protecting the personal data are documented at /securityand include: TLS 1.3 in transit; AES-256-GCM at rest; forced row-level security per tenant; least-privilege role-based access; signed audit logs; brute-force-resistant rate limits on authentication endpoints; periodic internal security reviews; and an incident-response runbook with a 72-hour breach-notification target for GDPR-scoped incidents (India CERT-In’s stricter 6-hour reporting clock governs in-scope cyber incidents first, given the importer is India-incorporated and India-hosted). Automated encrypted off-site database backups are on our roadmap, not yet running — see /security. All data is stored in India; EU data residency is not currently offered.
5. Annex III — Sub-processors
The list of authorised sub-processors is published at /legal/sub-processorsand updated on at least 30 days’ notice. Each sub-processor is bound by data-protection obligations no less protective than these SCCs.
6. Schrems II — supplementary measures
Following the CJEU judgment in Data Protection Commissioner v. Facebook Ireland and Schrems (C-311/18), the importer has assessed the laws of India regarding government access to data and applies the following supplementary measures: envelope encryption (AES-256-GCM) at rest with server-managed keys (ENC:v1:); a contractual no-model-training commitment from our LLM sub-processor (Anthropic) and TLS 1.3 encryption in transit for all data sent to sub-processors; and a contractual commitment to challenge any access request that is not narrowly tailored, proportionate, and judicially reviewed. Tenant content (including full conversation and memo text) is transmitted to Anthropic for inference — see the Privacy Policy §4 and the DPA §2/§6 for what is transferred, and the Acceptable Use Policy for what Customers should not submit.
7. Data-subject rights and complaints
Data subjects may exercise their GDPR rights (Articles 15–22) directly with the Customer (Controller) or via privacy@cortex.pleisys.com. Complaints may be lodged with the supervisory authority of the data subject’s habitual residence.
8. Signing
A signed counterpart of these SCCs is available to Customers on request. Contact legal@cortex.pleisys.com with the legal name and registered address of the contracting entity, and we will return a counter-signed PDF within 5 business days.