respondology mark

Standard Contractual Clauses (EU/UK)

Last updated: Oct 1, 2025

These Standard Contractual Clauses (“SCCs”) are incorporated by reference into Respondology’s Data Processing Agreement (“DPA”) and apply where Client Personal Data is transferred outside the EEA/UK to a country without an adequacy decision. Capitalized terms not defined here have the meaning given in the DPA.

By entering into the Software as a Service Agreement and the DPA, the parties are deemed to have executed these SCCs (including the UK Addendum where applicable) as of the DPA effective date. If either party requires a signed copy in the official EU or UK template format (including table-based Annexes/IDTA), Respondology will provide such copy upon request.

1) How to Use These SCCs

These SCCs are deemed executed between the data exporter (Client) and the data importer (Respondology) whenever the DPA applies and Client Personal Data is transferred from the EEA/UK to a third country without an adequacy decision. Respondology does not modify the SCC legal text. The operative text of the EU Commission SCCs (2021/914) is incorporated by reference; if there is any discrepancy between a copy and the official text, the official text prevails.

2) EU Commission SCCs (2021/914)

Reference: Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679.

Operative Text: The full text of the EU SCCs (Controller to Processor) applies and is incorporated here by reference.

3) Module Selection & Options

  • Selected Module: Module Two — Controller to Processor (C→P)
  • Clause 7 (Docking Clause): Included (additional parties may accede).
  • Clause 9 (Subprocessors): General authorization; Respondology maintains an up-to-date list at trust.respondology.com and provides advance notice of changes via that page.
  • Clause 11 (Redress): Not applicable to Respondology as processor (no voluntary redress mechanism offered).
  • Clause 17 (Governing Law): Laws of Ireland.
  • Clause 18 (Forum & Jurisdiction): Courts of Ireland.

Annex I — Description of Processing

A. List of Parties

Data Exporter (Controller): The Client identified in the applicable Order Form.
Contact details: as specified in the Order Form or DPA.

Data Importer (Processor): Respondology, LLC. Address: 2101 Pearl St, Boulder, CO 80302, USA.
Contact: security@respondology.com.

B. Description of Transfer

Categories of data subjects: Social media users, app/community/forum participants, website commenters, and Client personnel (if included in metadata).

Categories of personal data: Usernames/handles, display names, profile links, avatars, comment text and attachments, content IDs, timestamps, moderation signals and outcomes, and any personal data Client includes in submitted content or metadata.

Sensitive data processed: Not intended; may be incidentally present within free-text content submitted by Client. Client is responsible for lawful submission of any such data.

Frequency of transfer: Continuous or as determined by Client’s platform configuration or API usage.

Nature and purpose of processing: To receive, analyze, and return results on user-generated content submitted through Customer Content Sources for the purpose of enabling Customers to manage online interactions. Processing includes, depending on products purchased: (a) applying automated rules, machine learning models, and human review to identify and classify comments or other content for potential hiding, removal, or escalation; (b) extracting insights such as topics, trends, sentiment, and related metrics to support Customer’s analysis and decision-making; and (c) generating and delivering proposed responses to user content, based on parameters and guidance provided by Customer, with options for human oversight. Processing also involves storage, transmission, and display of Customer Content as necessary to provide these functions, together with related account configuration, reporting, system maintenance, security, and product improvement. Where Customer uses Respondology’s API or provides other Customer Content Sources, Respondology processes such data in the same manner to deliver the moderation, intelligence, and response functions
described above.

Retention period: For the Subscription Term and limited periods thereafter for backups, dispute resolution, and legal compliance, as described in the DPA and Documentation.

Subject matter and duration of processing: For the purposes and duration of the client’s use of Respondology’s services, or until deletion is requested.

C. Competent Supervisory Authority

Determined in accordance with Clause 13 of the SCCs based on the data exporter’s EEA establishment or representative.

Annex II — Technical and Organizational Measures

Technical and organizational security measures are described in the Security Measures Exhibit to Respondology’s Data Processing Agreement, and further summarized on Respondology’s Trust Center.

Annex III — List of Sub-processors

Respondology uses sub-processors to support delivery of the Services. An up-to-date list is maintained at trust.respondology.com. Client provides general authorization to such sub-processors under Clause 9 of the SCCs. Respondology will provide advance notice of changes.

UK Addendum to the EU SCCs

For transfers subject to UK data protection law, the International Data Transfer Addendum to the EU Commission SCCs (the “UK Addendum”) issued by the UK Information Commissioner’s Office applies and is incorporated by reference. The UK Addendum is completed as follows:

  • Table 1 (Parties): As set out in Annex I(A) above.
  • Table 2 (Selected SCCs): EU 2021/914, Module Two (Controller to Processor), with options as specified in Section 3 above.
  • Table 3 (Annexes): Annexes I–III of this page apply.
  • Table 4 (Mandatory Clauses): The ICO’s mandatory clauses apply.

Execution & Incorporation

These SCCs (including the UK Addendum where applicable) are incorporated by reference into the DPA and deemed executed by the parties as of the DPA effective date. If a countersigned copy is required, Respondology will provide a signed PDF referencing these online SCCs and incorporating the Annexes above upon request.