Trust Center / EU-transfers annex
Annex to the DPA & subprocessor register v2026.2 · 2026-06-21
This annex states, per subprocessor, whether your personal data is transferred outside the EU/EEA and on what legal basis. We aim to be accurate rather than reassuring: where a transfer mechanism or a certification could not be verified, we say so ("to confirm") instead of asserting it.
Baseline mechanism. For third-country transfers we rely on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (controller-to-processor) or Module 3 (processor-to-processor) as applicable, with a Transfer Impact Assessment (TIA) where the destination has no adequacy decision and presents heightened risk.
EU-US Data Privacy Framework. Where a US provider is self-certified under the EU-US DPF, that can also support a transfer. The DPF adequacy decision is currently in force; it survived a first annulment challenge (EU General Court, September 2025) and an appeal is pending (Case C-703/25 P, no hearing date as of mid-2026). Because of that uncertainty — and because we could not verify each provider's self-certification against the official register at the time of writing — we treat the SCCs as the primary mechanism and mark DPF status as "to confirm" rather than relied-upon.
Our video-generation provider, Higgsfield (US), forwards each render to an onward model engine. One of those engines, Kling, is operated by Kuaishou with data storage in Singapore and Singapore-law governance; as a Kuaishou product, processing in China cannot be excluded. Singapore has no EU adequacy decision. An earlier version of our register described this as a US transfer — that was inaccurate. The correct posture is an onward transfer under SCCs (Module 3) with a documented Transfer Impact Assessment. If your DPO requires that Kling be excluded, contact legal@arcamatrix.com — the engine is selectable.
EU Standard Contractual Clauses (Module 2/3, Commission Decision (EU) 2021/914) are auto-incorporated in Anthropic's DPA (effective 2026-02-24) per Art. 46(2)(c) GDPR. DPF self-certification: to confirm against the official register.
Contracted through OpenAI Ireland Ltd; onward transfers to US affiliates on EU Standard Contractual Clauses (Module 2/3) per the OpenAI DPA. DPF self-certification: to confirm.
Higgsfield (US) is the contracted provider on EU SCCs. It forwards each render to one of several onward model engines whose jurisdictions DIFFER from Higgsfield's — in particular Kling (Kuaishou) processes on servers in Singapore (no EU adequacy decision). For those onward transfers we rely on SCCs and maintain a documented Transfer Impact Assessment (TIA). See the onward-subprocessor breakdown and the EU-transfers annex.
Onward engines
Kling (Kuaishou Technology) (SCC + TIA)
Singapore (servers; operator Beijing-based, processing may occur in China) — No EU adequacy decision for Singapore. Transfer relies on SCCs (processor-to-processor, Module 3 on the onward leg) PLUS a documented Transfer Impact Assessment. Kling's own terms state Singapore data storage and Singapore-law governance; as a Kuaishou product, processing in China cannot be excluded — assessed in the TIA.
Seedance (ByteDance) (SCC + TIA)
Operator ByteDance; processing region to confirm — No EU adequacy decision. Engaged only when the high-motion engine is selected; covered by onward SCCs + TIA on the same basis as Kling. Exact processing region to confirm with the provider.
Veo (Google) (SCC)
US (Google) — Google as the hero-quality engine; US transfer on SCCs/Google's DPA. DPF self-certification: to confirm.
Wan (Alibaba) (SCC + TIA)
Operator Alibaba; processing region to confirm — Used for the audio-driven talking-head engine. No EU adequacy decision; onward SCCs + TIA. Processing region to confirm.
fal.ai is the default vendor for AI-generated images in the pipeline (Higgsfield is the automatic fallback). US transfer on SCCs per fal.ai's terms. DPF self-certification: to confirm.
Engaged ONLY when an ElevenLabs API key is configured; otherwise voiceover is produced by self-hosted TTS on EU infrastructure (Hetzner) and no transfer to ElevenLabs occurs. When engaged: US transfer on SCCs. DPF self-certification: to confirm.
Edge processing of request metadata; US/global transfers under Cloudflare's DPA + SCCs. DPF self-certification: to confirm.
Region-configurable Redis. Where a US region is used, transfer is on SCCs per Upstash's DPA. DPF self-certification: to confirm.
Billing data to Stripe; US transfer on SCCs per Stripe's DPA. DPF self-certification: to confirm.
Set ONLY after explicit analytics-cookie consent. US transfer on SCCs per PostHog's DPA. DPF self-certification: to confirm. An EU-region deployment is available and to be evaluated.
Error/performance telemetry, consent-gated. US transfer on SCCs per Sentry's DPA. A DPF self-certification is referenced by Sentry but is shown here as 'to confirm' pending verification against the official register; the SCC baseline applies regardless.
| Engine | Via | Region | Mechanism |
|---|---|---|---|
| Kling (Kuaishou Technology) | Higgsfield | Singapore (servers; operator Beijing-based, processing may occur in China) | SCC + TIA |
| Seedance (ByteDance) | Higgsfield | Operator ByteDance; processing region to confirm | SCC + TIA |
| Veo (Google) | Higgsfield | US (Google) | SCC |
| Wan (Alibaba) | Higgsfield | Operator Alibaba; processing region to confirm | SCC + TIA |
See also Trust Center · Subprocessor register · DPA · TOMs annex