Jurisdiction Specific Terms. Certain jurisdictions require other specific terms. Where required under applicable Data Protection Law, this DPA fully incorporates the applicable Jurisdiction Specific Terms as follows:
European Economic Area,United Kingdom, and Switzerland:
KYRO complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK-US Data Bridge Extension Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. KYRO has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK-US Data Bridge. KYRO has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.
Brazil:
Brazilian Law No. 13,709/2018 – BrazilianGeneral Data Protection Law, Lei Geral de Proteção de Dados (“LGPD”).
KYRO’s obligations to a Customer under the DPA are only those express obligations imposed by LGPD on a "Data Processor (operador)" for the benefit of a "Data Controller (Controlador)" (including new Section 10 below), as "Data Controller (controlador)" and "Data Processor (operador)" are defined by the LGPD. Each party is responsible for fulfilling its respective obligations set out in the LGPD, and Customer issues Processing instructions consistent with Section 2.1 of the DPA in order to enable KYRO to fulfill its LGPD obligations.
For the purpose of international transfers of Personal Data from Brazil, the EU SCCs will be used for transfers to non-adequate countries as per GDPR.
Singapore:
Personal Data Protection Act 2012 (“PDPA”).
KYRO’s obligations to Customer under the PDPA are only those express obligations imposed by the PDPA that require that an “Organisation” and “Data Intermediary” to have in place. Each party is responsible for fulfilling its respective obligations set out in the PDPA, and KYRO will process Personal Data to a standard of protection at least comparable to the standard provided under the PDPA and complying with the terms of the Agreement
The terms used in the applicable provisions of the DPA shall be replaced as follows: "Controller" shall mean "Organisation"; "Processor" shall mean "Data Intermediary"; and "Data Subject" shall mean "Individual" (collectively, the “replaced terms”). Further, the replaced terms shall have the definitions ascribed to in the PDPA.
State of California, United States:
The California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., and its implementing regulations.
KYRO’s obligations to Customer under the DPA are only those express obligations imposed by the CCPA that require that a “Business” and a “Service Provider” to have in place. Each party is responsible for fulfilling its respective obligations set out in the CCPA.
KYRO will not collect, sell, retain, disclose or use the Personal Information of the Consumer for any purpose other than to perform the Subscription Services specified in the Agreement, or as otherwise permitted by CCPA. KYRO certifies that it understands and will comply with the restrictions set forth herein.
The terms used in the applicable provisions of the DPA shall be replaced as follows: “Personal Data” shall mean "Personal Information"; "Controller" shall mean "Business"; "Processor" shall mean "Service Provider"; and "Data Subject" shall mean "Consumer" (collectively, the “replaced terms”). Further, the replaced terms shall have the definitions ascribed to in the CCPA.