← Back to Trust CentreStandard Contractual Clauses (SCCs)
Schedule 1 to the Britwise DPA · Module 2 (Controller-to-Processor) · EU Commission Decision 2021/914 · UK IDTA equivalent
Applicability
These SCCs apply automatically when Personal Data is transferred from a UK / EU / EEA controller to a Britwise sub-processor located outside the UK / EEA (primarily: OpenAI US fallback, Anthropic US fallback). All other processing remains within Helsinki (Finland, EU).
Module elected
Module Two — Transfer Controller to Processor. Britwise acts as the data importer.
Annex I — Description of transfer
(A) Data exporter: Customer (Controller). (B) Data importer: Britwise School Ltd. (C) Categories of data subjects: employees, students, learners. (D) Categories of personal data: name, email, voice recordings, transcripts, progress scores. (E) Special categories: none. (F) Frequency: continuous (real-time API). (G) Nature of processing: AI inference, transcription, analytics. (H) Purpose: English coaching service delivery. (I) Retention: 24 months active + 7 years audit (financial records). (J) Sub-processors: see Britwise DPA Section 3.
Annex II — Technical and organisational measures
See Britwise DPA Section 5. Summary: TLS 1.3 in transit, AES-256 at rest, EU endpoint preference for all AI providers, anonymisation before fallback to US endpoints, MFA + RBAC + audit logging.
Annex III — List of sub-processors
OpenAI · Anthropic · Deepgram · ElevenLabs · MongoDB Atlas · Hetzner · Resend · Stripe. Maintained at britwise.school/trust. 30-day notice before changes.
Governing law
Module Two SCCs are governed by Irish law (EU exporter) or English law (UK exporter). Courts of Dublin or London respectively.
To execute the SCCs for your organisation, email dpo@britwise.school. We sign electronically via DocuSign within 2 business days.