Orygent International Transfer Schedule
1. Map the actual transfer
Identify exporter, importer, controller/processor role, country, recipient function, categories/subjects, frequency, onward access and hosting/support access. No default assumption is made that a Spanish domain stays in the EEA or that a UK domain uses a UK-established operator. If no restricted transfer occurs, record that fact and maintain a change trigger rather than attaching irrelevant SCCs.
2. Select and execute the instrument
Use a current applicable adequacy decision only within its scope and validity. Otherwise select the correct EU SCC module and complete its parties, annexes, technical/organizational measures and subprocessor details; keep the Commission's mandatory clauses intact. For a UK restricted transfer use the appropriate current UK IDTA or approved UK Addendum and complete its tables. This explanatory schedule is not itself a signed SCC/IDTA and does not replace their operative text.
3. Assessment and controls
Assess actual destination law, government access, data sensitivity and practical safeguards. Document access controls, encryption/key control, minimization, pseudonymization, complaint/redress and onward-transfer limits where relevant. Reassess material vendor, country or legal changes. If an instruction cannot be lawfully fulfilled, pause that transfer and seek a compliant alternative; do not paper over it with generic consent.
4. Release condition
No transfer is marked approved until the data map, importer identity, executed instrument, annexes, impact/risk assessment and supplementary measures are recorded. Data subjects retain the instrument's enforceable rights; disclose a lawful way to obtain relevant safeguards without disclosing others' secrets.
Platform-specific terms
Enterprise AI operations
1. The customer appoints tenant administrators who manage users, authority levels and data classes within the tenant. Actions with legal, financial or employment effect require approval by a human with the configured authority before execution; the service does not execute them automatically.
2. Employee data processed in the tenant is processed under the customer's instructions as controller; the DPA (DAT-01) applies.
3. Outputs are recommendations and drafts; decisions are the customer's.
---
AI services: disclosure, limitations and human escalation
1. Disclosure. Where you interact with an AI system (chat, voice, agent, digital twin or generated content), the Operator tells you so at the start of the interaction and labels AI-generated or AI-manipulated content in accordance with Article 50 of Regulation (EU) 2024/1689. A voice or persona representing a real person is used only with that person's recorded permission.
2. Nature of outputs. AI outputs are generated from models and data that can be incomplete or wrong. They are information and assistance, not professional advice, and not a decision of the Operator. You remain responsible for decisions you take on the basis of an output. Where a decision has legal, financial, medical, educational or safety effect, the service routes it to a human reviewer or to you for decision, and the Operator does not make that decision automatically.
3. Human escalation. You may at any time request a human review of an AI interaction through support@orygent.com or the in-product escalation control; the Operator responds within 5 business days (consumer) or within the SLA (business).
4. Permitted use. You will not use AI features to impersonate a person without permission, to generate unlawful content, to circumvent safety controls, or to extract or reverse-engineer models. The Operator may suspend AI features for breach.
5. Recording and model use. Recordings, transcripts and uploads are used to provide the service to you. They are used to improve models only with your separate permission (purpose research_contribution), which you may withdraw at any time without affecting the service.
---