Mandatory local provisions for the United States Australia China and Singapore

1 Applicability and priority

These provisions override conflicting general terms only to the extent the relevant mandatory law applies to the actual mandate or processing activity. A billing address or nationality alone does not establish a person’s location or the application of every privacy law. The provider remains responsible for its own duties; a blanket provider declaration does not replace the customer’s statutory obligations.

2 United States

The agreed use is advisory support for business changes. Supplying or using personal reports to evaluate individuals for hiring, promotion, reassignment or termination is outside this mandate. Such a change of purpose is a different service scope and requires the procedures then mandated before that use begins. Calling a service advisory does not determine the legal treatment of a different actual use.

Non-waivable rights under applicable federal and state law remain intact. This supplement does not assert that every state privacy statute applies to every customer or that its applicability conditions have already been established.

3 Australia

Where mandatory guarantees and remedies under the Australian Consumer Law apply, business-customer status, German governing law, limitations on results and the general liability clause do not exclude or restrict them. The provider owes the legally required care and skill, legally required fitness and timely supply. Statutory remedies, cancellation, refunds and damages remain available to their statutory extent.

A business may qualify for these protections. Coverage depends on the statutory conditions, including the applicable AUD 100,000 monetary threshold including GST and other statutory grounds.

If a customer subject to the Australian Privacy Act discloses personal information to VERION overseas, that disclosure must meet the applicable APP 8 requirements. The provider assists the necessary safeguards and supplies the relevant recipient and processing information. Accepting this agreement is not consent to waive the exporter’s statutory accountability.

4 Mainland China

For processing of people located in mainland China within PIPL scope, understandable advance information about controllers, purposes, data, retention and rights must be provided. The business customer’s acceptance does not replace a required individual’s separate consent to an overseas transfer; statutory exceptions depend on their actual conditions.

Where prescribed, the impact assessment and applicable export requirements must be completed before processing. Statutory exemptions effective since 2024 from security assessment, standard contracts or certification must be considered. Neither a universal filing requirement nor an exemption without its conditions is asserted.

If VERION falls within Article 3(2) PIPL’s extraterritorial scope, VERION must designate the local entity or representative and make the notification required by Article 53. This supplement appoints no unconfirmed representative and replaces no actual export documentation. Required entrusted-processing agreements and onward-delegation permissions must be in place.

5 Singapore

A transfer of personal data out of Singapore subject to the PDPA must ensure the prescribed, at least comparable protection at the overseas recipient under a permitted basis. Where contractual safeguards are relied on, VERION undertakes at least comparable protection for the relevant data; processing countries and territories and permitted onward transfers must be identified in the actual transfer documentation. A confirmed server location alone does not supply that documentation.

When acting as the customer’s Data Intermediary for this processing, VERION processes for the purpose documented in writing, provides appropriate protection, ends retention that is no longer required and informs the customer of known data breaches without undue delay. The customer retains its own statutory responsibilities.

The Business Contact Information exception applies only to the business contact details covered by the statute. It does not turn participant answers, behavioural analyses or profiles into exempt contact information merely because the customer is a business.