Supplemental Privacy Addendum: International Data Transfers & Standard Contractual Clauses (SCCs)

Supplemental Privacy Addendum: International Data Transfers & Standard Contractual Clauses (SCCs)

Effective Date: July 1, 2025

Last Updated: August 6, 2025

This Privacy Addendum (“Addendum”) supplements the Shobbl LLC (“Shobbl”, “we”, “us”, or “our”) Global Privacy Policy. Shobbl LLC transfers personal data internationally, including transfers subject to Standard Contractual Clauses (“SCCs”) or equivalent mechanisms under applicable law.

1. Scope and Purpose

This Addendum applies to all personal data transferred by Shobbl across international borders, including but not limited to the European Economic Area (EEA), United Kingdom, Brazil, Turkey, Kingdom of Saudi Arabia (KSA), LATAM, and Canada, where SCCs or similar legal mechanisms are required.

1.1 Areas of Service

Shobbl provides services exclusively to the following regions: the EU (excluding the UK), the USA, and Canada. We are actively working towards compliance with other jurisdictions. Access to our website from countries outside these specified service areas will be restricted.

2. International Data Transfers

2.1 Transfer Mechanisms

Shobbl implements the following safeguards for international data transfers:

• Standard Contractual Clauses (SCCs): For data transfers from the EEA, UK, and other regions requiring SCCs, Shobbl uses the latest approved SCCs to ensure adequate data protection.
• Adequacy Decisions: Where applicable, Shobbl relies on adequacy decisions by relevant authorities for data transfers.
• Data Processing Agreements (DPAs): All third-party processors and partners are required to sign DPAs aligned with GDPR or other applicable regional laws when importing or exporting our controlled data in reference to residents of the European Union ("EU") or European Economic Area ("EEA").
• Technical and Organizational Safeguards: Measures such as AES-256 encryption, TLS 1.3, access controls, and secure protocols are enforced to protect data during transfer and storage.

2.2 Data Processing Locations

Personal data may be processed in the United States and other jurisdictions as required for service delivery and legal compliance. Data processing locations are selected based on compliance with applicable SCCs and regional requirements.

3. Jurisdiction-Specific SCC Provisions

3.1 European Economic Area (EEA) & United Kingdom

• Transfers are governed by the EU Commission-approved SCCs or UK International Data Transfer Addendum.
• Data subjects have rights under GDPR/UK GDPR, including access, rectification, deletion, restriction, portability, and the right to lodge complaints.

3.2 Brazil

• Data Transfers are governed by the Brazil SCCs under Law No. 13.709/2018 (LGPD).
• Data subjects have rights to access, correct, delete, and object to processing as per LGPD.

3.3 LATAM and Canada

• Data Transfers are governed by LATAM and Canada SCCs, as required by local law, including the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada.
• Data subjects have rights as defined by applicable national data protection laws.

3.4 Turkey

• Data Transfers are governed by Turkey SCCs under Law No. 6698 and related regulations.
• Data subjects have rights to access, correct, and delete personal data.

3.5 Kingdom of Saudi Arabia (KSA)

• Data Transfers are governed by KSA SCCs under the Personal Data Protection Law.
• Data subjects have rights as defined by KSA law.

4. Roles and Responsibilities

Depending on the relationship, Shobbl may act as:

• Data Exporter (Controller or Processor): Shobbl transfers data to a third party (importer) under SCCs.
• Data Importer (Controller or Processor): Shobbl receives data from another entity under SCCs.

The applicable SCC module (Controller-Controller, Controller-Processor, Processor-Processor, Processor-Controller) will be determined by the nature of the relationship.

5. Updates to this Addendum

Shobbl may update this Addendum to reflect changes in laws or our practices. The effective date will be updated accordingly. Continued use of our services constitutes acceptance of the updated Addendum.