> For the complete documentation index, see [llms.txt](https://docs.ultie.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ultie.org/site-policy/organizer-dpa.md). # Organizer Data Processing Agreement * Last updated: 24 August 2026 ## 1. Parties and Effect This Organizer Data Processing Agreement, including Schedules 1–4 (the **DPA**), is between: 1. the individual who accepts personally, or the organization identified when an authorized creator accepts for it, under the applicable Organizer Terms, Order, or other agreement for Ultie services (**Organizer**); and 2. **ULTIE LTD**, a company registered in England and Wales under company number 16415880, with its registered office at 124–128 City Road, London, England, EC1V 2NX (**Ultie**). This DPA forms part of the agreement under which Ultie provides Event-administration services to the Organizer (the **Agreement**). It takes effect when the Organizer accepts the Organizer Terms and this DPA through the required recorded acceptance, when the parties sign it, or when another written acceptance method is stated in the Agreement. For standard self-service Event creation, the acceptance route and evidence are described in the Organizer Terms. The DPA version accepted for the Event is recorded with that acceptance. If there is a conflict: 1. a mandatory transfer mechanism governs the restricted transfer it covers; 2. this DPA governs Processing of Organizer Personal Data; and 3. the rest of the Agreement governs other matters. ## 2. Definitions In this DPA: * **Applicable Data Protection Law** means the UK GDPR, the Data Protection Act 2018, the EU GDPR where it applies, and other data-protection law applicable to Processing under this DPA. * **Controller**, **Data Subject**, **Personal Data**, **Personal Data Breach**, **Processing**, and **Processor** have the meanings given by Applicable Data Protection Law. * **Event** means a Tournament, League, or Hat administered through Ultie. * **Organizer Personal Data** means Personal Data that Ultie processes as Processor on the Organizer's documented instructions for the activities in Schedule 1. * **Subprocessor** means another Processor engaged by Ultie to process Organizer Personal Data. * **UK GDPR** means the GDPR as it forms part of UK law. * **EU GDPR** means Regulation (EU) 2016/679. Account, Club, Team, Roster, Global profile, Family manager, Event player profile, Division, and Game have their product meanings in Ultie. ## 3. Roles and Scope For Organizer Personal Data: * the Organizer is Controller; and * Ultie is Processor. This allocation applies only to Organizer-directed Event activities in Schedule 1. It does not make the Organizer Controller of every record in Ultie. Ultie acts separately as Controller for purposes it determines, including: * Accounts, authentication, and Global profiles; * Family accounts and platform-wide age rules; * platform security, diagnostics, support, and service notices; * cookie choices and Ultie's analytics; * Ultie's contract formation and acceptance evidence, corporate accounting, compliance, dispute, and legal-claim records; and * the published historical sports record identified in Schedule 1. The Organizer may connect Mollie or Stripe as its active online payment provider. The provider acts separately as controller for the payment service supplied through the Organizer's own connected account under the provider's terms and privacy information. Ultie processes only the Event payment and accounting fields listed in Schedule 1. One provider may be active for future payment attempts, while completed-payment history remains tied to the provider that processed it. This DPA does not cover: * persistent Club-membership administration, for which Ultie acts as controller; * Personal Data processed for another customer or Event; or * Personal Data the Organizer processes outside Ultie. An Event-scoped snapshot of a Club name and avatar used in an Event application is within this DPA. Editing the Event snapshot does not change the persistent Club profile. ## 4. Documented Instructions The Organizer instructs Ultie to process Organizer Personal Data: * to provide the services described in the Agreement and Schedule 1; * through the Organizer's and authorized users' configuration and use of Ultie; * through actions taken by authorized Event staff and Team managers within their supported roles; and * under another written instruction consistent with the Agreement. Ultie will process Organizer Personal Data only on documented instructions, including for international transfers, unless applicable UK, EU, or Member State law requires otherwise. Ultie will inform the Organizer of that requirement before Processing unless the law prohibits notice on important public-interest grounds. Ultie will inform the Organizer immediately if, in Ultie's reasonable view, an instruction infringes Applicable Data Protection Law. Ultie may suspend the affected Processing while the instruction is clarified or corrected. ### Standing instruction for prohibited data The standard service is not designed for health, medical, biometric, racial or ethnic origin, religious or philosophical belief, sexual-life, sexual-orientation, criminal-conviction, or other special-category or similarly high-risk information. The Organizer must not design a field, form, survey, or note that requests such information. Non-medical emergency-contact details are permitted. If prohibited information is entered unexpectedly through free text, the Organizer instructs Ultie to restrict access and delete or otherwise remediate the information under the documented procedure. This standing instruction does not represent that free-text entry is technically impossible. An instruction that materially changes the scope, risk, cost, or technical design of the service requires Ultie's written agreement and may require an updated Schedule or separate agreement. ## 5. Organizer Responsibilities The Organizer is responsible for: * having a lawful basis and any required additional condition for its Processing; * providing required privacy information to Data Subjects; * deciding which Event fields, forms, surveys, waivers, messages, and recipients are necessary; * ensuring its Event, waiver, refund, form, and communication content is lawful and appropriate; * verifying the authority of a person who signs a Minor waiver and deciding whether to admit the participant; * ensuring adult-signing and external-signer flows are used only by people authorized to act; * limiting Event access to authorized personnel and removing access when no longer needed; * responding to Data Subjects as Controller, with Ultie's assistance where required; * keeping Organizer Accounts, credentials, devices, and exports secure; * complying with the special-category prohibition and remediation instruction in Section 4; and * ensuring instructions are lawful, complete, accurate, and within the agreed service. The Organizer must not instruct Ultie to process Personal Data in a discriminatory, misleading, unlawful, or unsafe manner. ## 6. Ultie Obligations Ultie will: * process Organizer Personal Data only as permitted by this DPA; * ensure authorized personnel are bound by confidentiality; * implement and maintain the measures in Schedule 2; * maintain records of Processing where required; * provide information reasonably necessary to demonstrate compliance with this DPA; * assist the Organizer under Sections 8–10; * manage Subprocessors under Section 11 and Schedule 3; * handle international transfers under Section 12 and Schedule 4; and * return or delete Organizer Personal Data under Section 13. Ultie remains responsible to the Organizer for each Subprocessor's performance of the data-protection obligations applicable to that Subprocessor's Processing. ## 7. Security Ultie will maintain technical and organizational measures appropriate to the nature, scope, context, purpose, and risks of Processing and to the state of the art and implementation cost. The minimum contractual control outcomes are in Schedule 2. Ultie may update a measure where the change does not materially reduce the overall protection of Organizer Personal Data. Security is shared. The Organizer is responsible for its users, roles, devices, exported files, content, and lawful configuration. Ultie is responsible for the service components it controls. ## 8. Personal Data Breaches Ultie will notify the Organizer without undue delay after becoming aware of a Personal Data Breach affecting Organizer Personal Data. The notice will include available information reasonably needed for the Organizer's obligations, including where known: * the nature of the breach; * affected Personal Data and Data Subjects; * likely consequences; * measures taken or proposed; and * a route for follow-up. Ultie may provide information in stages. Ultie will take reasonable steps to contain, investigate, mitigate, and document the breach. The Organizer remains responsible for deciding whether it must notify a supervisory authority or Data Subjects. ## 9. Data Subject Requests Taking account of the nature of Processing, Ultie will use appropriate measures to help the Organizer respond to Data Subject requests. If Ultie receives a request clearly concerning Organizer Personal Data, Ultie will: * direct the requester to the Organizer or forward the request where appropriate; * not answer on the Organizer's behalf unless instructed or legally required; and * retain the request only as needed to route it, assist, and keep any required completion record. Ultie may respond directly where the request concerns Processing for which Ultie is Controller, including the published historical sports record. ## 10. Compliance Assistance Taking account of the nature of Processing and information available to Ultie, Ultie will reasonably assist the Organizer with: * security obligations; * Personal Data Breach assessment and notification; * data protection impact assessments; * prior consultation with a supervisory authority; and * information needed to demonstrate compliance. The Organizer will provide enough context and reasonable time. Assistance outside the standard service may be subject to reasonable fees under the Agreement unless it is required because Ultie breached this DPA. ## 11. Subprocessors The Organizer gives Ultie general written authorization to use the Subprocessors in Schedule 3. Ultie will: * enter into a written agreement imposing equivalent data-protection obligations for the relevant Processing; * assess whether each Subprocessor provides sufficient guarantees; * remain responsible for the Subprocessor's applicable performance; and * give reasonable advance notice of an intended new or replacement Subprocessor. The Organizer may object on reasonable data-protection grounds. The parties will work in good faith to resolve the objection. If they cannot, Ultie may offer a reasonable change to the affected service or either party may terminate only the affected Processing under the Agreement. The Schedule 3 version accepted with this DPA is immutable for acceptance evidence. Routine changes follow the notice and objection route above and do not require re-acceptance of the full DPA unless the change materially alters the agreed subprocessor regime. ## 12. International Transfers Ultie will transfer Organizer Personal Data internationally only: * on the Organizer's documented instructions; * as needed through an authorized Subprocessor; or * where applicable law requires it. Where a safeguard is required, the applicable mechanism in Schedule 4 will be completed for the actual parties, roles, Processing, and countries before the restricted transfer begins. ## 13. Return, Deletion, and End of Processing During the service, the Organizer may retrieve Organizer Personal Data through the standard exports available within the Event lifecycle described in Schedule 1. The standard period for Event-panel and export access lasts for one calendar year after the Event end date recorded by the Organizer. If the Organizer needs Organizer Personal Data relating to it that is not included in the standard export files, it may request reasonable assistance through Ultie support while the data remains available under the applicable lifecycle. A support request does not extend an applicable retention period. When the Agreement, relevant Processing, or applicable lifecycle ends, Ultie will automatically delete the operational Organizer Personal Data whose retention period has ended. The Organizer's return option is provided through the standard exports and the support route above while the data remains available. Schedule 1 remains the Organizer's documented instruction for category-specific retention that continues after the relevant Processing ends, including waiver, financial, historical-result, dispute, and legal-claim records. Those separate periods, and retention required by applicable law, are not shortened by the end of the ordinary Event lifecycle. Ultie will apply the corresponding deletion instructions to Subprocessors. Deleted production data may remain beyond ordinary use in protected backups until automatic overwrite, for no more than 90 days. Ultie will not query, repurpose, or return it to permanent production. If a backup is restored, applicable deletion instructions are reapplied before the restored environment becomes permanent production state. This obligation does not require Ultie to delete: * an Account, Global profile, Family account, or Club record for which Ultie or another controller is responsible; * the separately identified Ultie-controller historical sports record; * a record Ultie must keep for a legal obligation or specifically documented legal claim; or * Personal Data controlled by another Organizer, Club, or person. If requested, Ultie will provide reasonable confirmation that deletion has completed under the applicable process. ## 14. Information and Audits Ultie will make available information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR or EU GDPR, as applicable. The Organizer may audit compliance itself or through an independent auditor bound by confidentiality. Before requesting an on-site inspection, the Organizer will reasonably consider current reports, summaries, questionnaires, and other evidence Ultie makes available. An audit must: * relate to Organizer Personal Data and this DPA; * occur no more than once in any 12-month period, on at least 30 days' written notice, with reasonable scope, timing, and duration; * start from current reports, summaries, questionnaires, and other evidence Ultie makes available; an on-site inspection occurs only where that evidence is objectively insufficient for the stated compliance purpose; * protect another customer's information, restricted security material, and privilege; * avoid unreasonable disruption; and * follow reasonable confidentiality and security requirements. These limits do not restrict a competent supervisory authority or an urgent audit justified by a material incident or credible compliance concern. The Organizer bears the costs of an audit it initiates. Ultie bears its own reasonable remediation cost where an audit identifies a material breach by Ultie. ## 15. Changes to This DPA Ultie will give reasonable advance notice of a material change to this DPA. A material change includes a change to Processing scope or purpose, Data Subject or Personal Data categories, instruction mechanics, deletion/return rights, liability, a reduction in security commitments, or the subprocessor regime beyond a routine Schedule 3 update. For the standard self-service route, the version accepted for an Event remains fixed to that Event. A later standard version applies to new Events only. Typographical, formatting, contact-detail, and non-substantive clarification changes may be published without rewriting an existing Event's accepted version. ## 16. Notices, Term, and Governing Terms Notices follow the method in the Agreement. Operational privacy correspondence may be sent to . Breach notices will be sent to the Organizer contact recorded for the Event or Agreement. This DPA continues while Ultie processes Organizer Personal Data. Confidentiality, retained-information, transfer, audit, liability, and deletion provisions survive as their subject matter requires. The governing law and dispute provisions in the Agreement apply unless a mandatory transfer mechanism requires otherwise. *** ## Schedule 1 — Processing Details ### 1. Subject matter Ultie's provision of Event-administration functionality on the Organizer's documented instructions. ### 2. Duration Processing continues for the Agreement term and the category-specific Event lifecycle, access, export, deletion, backup, waiver, financial, and lawful-retention periods below. ### 3. Nature of Processing Ultie may collect, receive, record, organize, structure, store, retrieve, display, route, transmit, export, restrict, delete, or irreversibly anonymize Organizer Personal Data as needed to provide the service. ### 4. Purposes * Event and Team applications; * participant and Team administration; * Rosters and Event player profiles; * Event-scoped Club name and avatar snapshots; * Organizer-defined forms and surveys; * Event waiver routing, signing, evidence, and storage; * scheduling, Games, scores, results, Spirit of the Game information, awards, and statistics; * Event operation and public Event pages; * Organizer-directed communications; * Event fee and payment-status administration; and * role access, exports, support, and deletion for those activities. ### 5. Categories of Data Subjects * adult and minor applicants and participants; * players and Roster members; * Team managers and Club representatives involved in an Event Team; * Family managers, parents, legal guardians, and external adult waiver signers; * payers and people represented in Event payment records; * Event staff acting within assigned roles; and * recipients of Organizer-directed communications. ### 6. Types of Personal Data * name and contact information; * date of birth, age, gender, country, and profile photo where relevant; * Club, Team, Event, Division, Roster, role, and participation relationships; * application information, form and survey answers, attachments, non-medical emergency contacts, notes, and review records; * waiver version, signer identity and authority, authority-attestation version, signature, timestamp, and technical evidence; * schedule, Game, score, result, Spirit of the Game, award, and statistic records; * payer name and email where needed, Team-balance links, payment identifier, original amount and currency, current net amount, fee, method, and status; * internal manual-refund accounting and chargeback or dispute evidence; * manual cash, bank, or cheque records; * name of the organization and active provider connected for online payments; * Organizer-directed message content, recipient, delivery, and bounce information; and * access, export, and audit metadata needed for Event operation. Full card or bank-account credentials and provider account-setup records are not Organizer Personal Data held by Ultie. ### 7. Prohibited special-category and criminal-offence data Special-category and criminal-offence information is outside the standard scope. The Organizer must follow the standing prohibition and remediation instruction in Section 4. ### 8. Children and waivers Organizer Personal Data may concern children and teenagers. The Organizer remains responsible for its lawful basis, Event privacy information, waiver requirement, signer-authority assessment, and participant admission decision. The minimum age for a self-managed Ultie Account is 13 by default and 14 in Spain. Below the applicable threshold, the person uses a Family-manager-managed profile. This Account rule does not confer adult authority and does not replace the separate waiver routes below. A person below the applicable self-managed Account threshold has no direct interaction path and acts only through an authenticated adult Family manager. Adults sign for themselves. For a Minor, the Family manager signs where the waiver is assigned through that route; otherwise a parent or another legally authorized external adult may sign. ### 9. Standard lifecycle instructions | Category | Standard instruction | | ---------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Temporary Event staff access | Payment Manager, Schedule Manager, Staff Manager, Scorekeeper, Limited scorekeeper, and Volunteer end when authorization ends and no later than 30 calendar days after the Event end date recorded by the Organizer; Schedule Manager has Schedule-only access; Staff Manager manages temporary Event roles but cannot assign or remove Owner or Admin; Volunteer itself grants no Event panel access | | Personal Event CSV access | Keep available for one calendar year after the Event end date recorded by the Organizer; block downloading for every role, including Owner and Admin, when that window ends | | Generated export file | Not stored server-side; delivered only to the authorized requester in an authenticated session | | Applications, Organizer forms, surveys, attachments, and nonpublic personal fields | Keep available in the ordinary Event panel for one calendar year after the Event end date recorded by the Organizer; then block display for every role and delete or irreversibly anonymize | | Cancelled Event personal data | Treat the recorded cancellation date as the Event end date and apply the ordinary 30-calendar-day and one-calendar-year windows; separately retained waiver, financial, security, dispute, or legal-claim evidence follows its own period | | Adult waiver and signing evidence | Retain 6 years after the Event end date recorded by the Organizer; full evidence remains in the ordinary Event panel for no more than one calendar year after that date and then moves to restricted archival access | | Minor waiver and signing evidence | Retain until the later of 6 years after the Event end date recorded by the Organizer or the player's 21st birthday; full evidence remains in the ordinary Event panel for no more than one calendar year after that date and then moves to restricted archival access | | Payment and financial records, including financial CSV data | Retain 6 years from the end of the financial year to which they relate, unless a documented legal hold applies; the one-year ordinary personal-data window does not shorten this period | | Organizer-directed transactional email content | Delete after 30 days | | Organizer-directed email delivery metadata | Delete after 90 days | | Ordinary server, authentication, application, and security logs | Delete within 90 days unless isolated for a documented incident or legal requirement | | Sentry error and performance diagnostic events | Delete within 90 days unless isolated for a documented incident or legal requirement | | Backup copies | Keep beyond ordinary use after production deletion and overwrite automatically within a hard maximum of 90 days | The Event end date recorded by the Organizer, not the last Game or a later public-date edit, starts the 30-calendar-day and one-calendar-year periods. For a cancelled Event, the recorded cancellation date is treated as the Event end date and starts the same periods. Owner and authorized Admin roles do not expire automatically. After the one-calendar-year window, ordinary personal or other non-public sensitive Event data is no longer displayed and ordinary personal-data CSV downloads are blocked for every role, including Owner and Admin. The historical panel then contains only the published sports record and records with separate retention periods. ### 10. Publication and Ultie's separate Controller record Until publication, Event information remains Organizer Personal Data under this DPA. Before publication, Ultie uses that data only on the Organizer's instructions to provide the Event service and does not independently use it for analytics, machine learning, benchmarking, or moderation beyond the Event title and style. From the moment information is published on a public Event page, Ultie maintains the published historical sports record as a separate Controller for the purpose of preserving the integrity, accuracy, and continuity of competitive sports results. The Organizer warrants that Event information is accurate and lawfully publishable at the moment of publication, including that participants received the information the Organizer is required to give them. From publication, Ultie provides the transparency information for the published record, handles data-subject requests concerning it, and is the single point of contact for data subjects regarding published records. If a competent supervisory authority or court determines that the parties are joint controllers for the act of publication, this Section records the essence of their arrangement under Article 26 UK/EU GDPR, and Ultie remains the contact point for data subjects. The separate record may include name, Team, Games, results, statistics, and profile photo. When Account or managed-child-profile deletion becomes final, the retained record normally consists only of name, Team, Games, results, and statistics; the photo becomes a neutral placeholder; and no link opens the deleted Global profile. Ultie may use `Player Unknown` through the approved case-by-case safety and rights route. All other Organizer Personal Data remains subject to the return and deletion lifecycle in Section 13. ### 11. Controller rights and obligations The Organizer retains the rights and obligations of Controller, including responsibility for instructions, transparency, legal bases, accuracy, rights requests, retention, and authorized access. *** ## Schedule 2 — Technical and Organizational Measures Ultie will maintain these minimum control outcomes for Organizer Personal Data according to the relevant system and risk. | Control area | Contractual measure | | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Governance and confidentiality | Access is limited to authorized personnel and providers with a work need. Authorized personnel are bound by confidentiality obligations. | | Product authorization | Role-based least-privilege controls separate Organizer, Event staff, Team manager, participant, and support access. Temporary Event roles expire under Schedule 1. | | Privileged access | Infrastructure and provider access is limited to authorized personnel, protected with multi-factor authentication, reviewed, and removed promptly on offboarding. | | Secrets | Credentials and service secrets are stored in protected systems and are not embedded in ordinary user-facing content or exports. | | Transmission security | Personal Data is protected in transit using TLS or an equivalent transport-security control appropriate to the Processing. | | Backup protection | Backups are access-restricted and protected using encryption or equivalent safeguards appropriate to the Processing and risk. | | Data minimization | Provider disclosures and diagnostic capture are limited to information needed for the relevant service. Forms, waivers, email content, dates of birth, and payment fields are excluded from Sentry. | | Logging and monitoring | Restricted operational, authentication, error, and security logging is used to identify and investigate service or security events. Ordinary logs are retained no longer than 90 days unless isolated for an incident or legal requirement. | | Retention and deletion | Ultie implements documented access, export, deletion, anonymization, and lifecycle instructions. Ordinary backups overwrite within 90 days. | | Restore controls | Deleted data in backups remains beyond ordinary use. If a backup is restored, applicable deletion instructions are reapplied before the environment becomes permanent production state. | | Availability and recovery | Protected backups support recovery. This measure does not create a specific recovery-time or recovery-point commitment. | | Incident handling | Ultie maintains processes to assess, contain, investigate, document, mitigate, and notify relevant Personal Data Breaches. | | Provider management | Ultie assesses Subprocessors, requires applicable written data-protection terms, and maintains the authorization and change process in Section 11. | | Review | Material controls are reviewed after relevant service, risk, incident, or legal changes and updated to maintain the protection required by this DPA. | This Schedule states control outcomes. It does not disclose credentials, confidential topology, operational identifiers, or recovery instructions. *** ## Schedule 3 — Authorized Subprocessors | Provider | Service and purpose | Organizer Personal Data categories | Main Processing location | Transfer treatment | | ---------------------------------- | ---------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------- | | Hetzner Online GmbH | Primary compute, database, and infrastructure hosting | All Organizer Personal Data stored in the primary service | Helsinki, Finland | EEA Processing; no restricted transfer for the confirmed storage location | | Amazon Web Services EMEA SARL | Encrypted backup storage and disaster recovery | Protected backup copies of Organizer Personal Data | Frankfurt, Germany; limited provider access may occur elsewhere | Provider DPA; adequacy or SCC/UK mechanism where required | | Cloudflare, Inc. | Network delivery, DNS, security, and abuse protection | IP address, request metadata, and limited content needed to deliver or protect requests | Cloudflare's global network | Provider DPA; adequacy or SCC/UK mechanism where required | | Mailgun Technologies, Inc. (Sinch) | Transactional email delivery | Recipient address, message content, Event reference, delivery and bounce metadata | Configured EU region; limited provider access may occur elsewhere | Provider DPA; adequacy or SCC/UK mechanism where required | | Functional Software, Inc. (Sentry) | Error and performance diagnostics; Session Replay is not enabled | Account or request reference, IP/device data, technical error context; excluded fields listed in Schedule 2 | EU storage; limited provider access as applicable | Adequacy or SCC/UK mechanism as applicable | This Schedule lists only providers engaged to process Organizer Personal Data. A service used solely for Ultie's separate Controller purposes, or a service a person chooses to use independently, is not a Subprocessor and is not listed in this Schedule. *** ## Schedule 4 — International Transfer Mechanisms This Schedule applies only where a transfer of Organizer Personal Data requires a safeguard. ### 1. EEA to United Kingdom Covered transfers may rely on the European Commission's adequacy decision for the United Kingdom while it remains valid. ### 2. Transfers to the Organizer (EU GDPR) For a restricted transfer of Organizer Personal Data from Ultie to an Organizer in a country without an applicable adequacy decision, the parties incorporate by reference the European Commission's Standard Contractual Clauses adopted under Decision (EU) 2021/914, **Module 4 (processor to controller)**. The annexes are completed from the recorded identity of the contracting Organizer and, as applicable, the individual's Country of residence or the organization's Country of registration, together with the processing description in Schedule 1. The completed module takes effect with the acceptance of this DPA without further signature. The Module 4 provisions governing security of transmission and all other mandatory safeguards apply without modification. ### 3. Transfers to the Organizer (UK GDPR) For a restricted transfer governed by the UK GDPR, the parties incorporate by reference the UK Addendum to the Standard Contractual Clauses on the same completed-at-acceptance basis, together with any required transfer-risk assessment. ### 4. Subprocessor chain, completion, and priority Transfers within the authorized Subprocessor chain rely on the mechanism identified in Schedule 3 for the relevant provider (adequacy, provider Standard Contractual Clauses, or another lawful mechanism). A mechanism must exist before the restricted transfer starts. Where a mandatory mechanism conflicts with this DPA for the covered transfer, the mandatory mechanism prevails.