Are there any GDPR-restricted international transfers of personal data between clients and Remote’s affiliates?

As of April 2022, Remote contracts customers solely through Remote Europe Holding BV, a business incorporated in the Netherlands. We include the 2021 SCCs (controller-controller) in our Terms of Service as a precaution since transfers can go both ways – from Remote to clients and from clients to Remote, as set out at clause 7 of the Data Sharing Addendum in the Terms which applies only to the extent there is a restricted transfer within the meaning of the GDPR. In practice, such transfers may occur when Remote sends out EU employee data, subject to the GDPR, to non-EU clients.

On the other hand, Remote receives employee personal data directly from the employees who upload it on the platform so there is no transfer there. The platform is hosted on AWS but it is Remote who makes it available to clients, so we deem there is no transfer between AWS and clients.

Transfers between the Remote affiliates and Remote Europe Holding BV are covered by our intra-group data sharing agreement which includes 2021 SCCs, but there can be no transfers between Remote affiliates and clients, since the only employee/contractor information we make available to clients is the information on the platform which is run by Remote Europe Holding BV and, as stated, provided to clients by Remote Europe Holding BV.